GitLab recently acquired two of the leading companies in the fuzz testing space - Peach Tech and Fuzzit! These two companies bring amazing technology into GitLab. Read on the learn more about the technology and how you can easily integrate fuzz testing into your workflow.
What is fuzz testing?
Fuzz testing is a powerful way to test your apps to find security issues and flaws in business logic that traditional QA methods miss. Fuzz testing works by passing randomly generated inputs to your app, and assesses the results.
When the app being tested crashes or behaves in an unexpected way, this is called a "fault." When a fault is discovered, that means there is a way for a user to provide a similar, but potentially malicious, input to your app in a production environment to crash or exploit it. Discovering faults lets you track down bugs in your code that you wouldn't find otherwise and lets you fix them before an attacker can exploit these weaknesses.
There are a few different methods for fuzz testing. The two primary methods are what we call "coverage-guided" fuzz testing and "behavioral" fuzz testing. Fuzzit and Peach Tech bring these to Gitlab, respectively. Both methods approach fuzz testing differently. Coverage-guided fuzz testing leverages the source code and instrumented versions of the app to be able to observe the app as it is running and dynamically make new tests during a fuzz testing session to exercise new parts of the app to find bugs. Behavioral fuzzing takes a specification of how the app is supposed to work and tries random inputs to test how it actually works - which usually will find bugs and security issues. Coverage-guided fuzzing and behavioral fuzzing have unique advantages and disadvantages, which is why GitLab aims to offer our users both options so you can choose the right one (or both!) for your use case.
What makes GitLab’s fuzz testing special?
Traditionally, fuzz testing has been difficult to set up and hard get results from. Some of the challenges with fuzz testing include assembling complex testing harnesses to run the fuzz tests and sorting through large amounts of results, including false positives. These challenges can make it time consuming and challenging to get meaningful results from fuzz testing. Bringing Peach Tech and Fuzzit fuzz testing techniques into the existing GitLab workflow means users can take advantage of the powerful benefits of fuzz testing without any of the traditional difficulties associated with fuzz testing. By bringing these two technologies into GitLab, we will make it easy for users to integrate fuzz testing into their workflows and present results in a meaningful and actionable way.
Preview of fuzz testing results in an MR.
GitLab will make fuzz testing part of our existing workflow so users do not need to use an external tool or interface. Instead, users simply include a CI job template to use the fuzz testing engines from Fuzzit and Peach Tech. Results will appear inline for developers, alongside the other build and test outputs they use today.
What about open source?
Open source is near and dear to our hearts at GitLab. We recently moved several features to our open source offering. We’ll continue supporting open source with fuzz testing as well. We have published several of our fuzz testing engines as open source, so they are accessible to any user and everyone can contribute. This will include several of the language-specific coverage-guided fuzz testing engines as well as Peach Tech Community Edition. In the future, we will consider what new fuzz testing pieces we can open source to the community as we build new capabilities for different use cases. One area we are considering is what we can do as we eventually move into protocol fuzz testing. Watch this space!
When can I get it?
GitLab will release the minimal version of fuzz testing later this year as part of GitLab Ultimate. This release will enable behavioral-guided fuzz testing of web APIs that follow the OpenAPI specification standard. We will also be enabling coverage-guided fuzz testing on apps written in a variety of languages, starting with Go.
What’s next?
GitLab is excited to add fuzz testing to the already large suite of application security scanners in GitLab’s Secure stage and make it part of the GitLab workflow that developers use already. This makes it easy to shift security left and take advantage of the benefits of fuzz testing.
As we mature our fuzz testing offering, we will make integrating fuzz testing results into new parts of the workflow a priority. So GitLab developers can directly view fuzz testing results and fix any issues they find. We will also focus on enabling advanced configuration options for users who want to customize their fuzz tests. Finally, we will be expanding fuzz testing to address additional use cases, beyond just web apps and APIs. You can read more about our plans for maturing fuzz testing on our direction page.
Cover image by Ian Baldwin on Unsplash
