networkingamerican-fuzzy-lopfuzz-testing

Why do not fuzz client


I am currently studying AFL of sorts, I notice that almost all the tutorial about networking fuzzing or protocol fuzzing is mainly testing the server instead of the client(I know that with -f parameter afl can test a client). I wonder if there are some reasons why people prefer to test server and do not test the client, will this cause insufficient test coverage?


Solution

  • That's just an arbitrary choice in the tutorials. Fuzzing clients is just as important as fuzzing servers, and for example all web browsers are extensively fuzzed to identify flaws.

    Depending on application though, attack surface may be very different between server and client. For some applications client only connects to trusted servers (ideally over encrypted & certificate-verified connection), while the servers are open for anyone to connect. But for other clients, such as web browsers, the server can be malicious also.