Fuzzing Go APIs for SQL Injection
blog.fuzzbuzz.io
Fuzzing Go APIs for SQL Injection
1–10 of 23 posts
Re: Fuzzing Go APIs for SQL Injection
#2A lot of folks we talk to think fuzzing is only useful for finding memory leaks in C++ programs, so we wanted to show how adding a single fuzz test to your API can find SQL injection and other logic bugs.
Would love to hear others' experience with Go fuzzing now that it's been out for a few months.
Re: Fuzzing Go APIs for SQL Injection
#3People are still constructing SQL statements using user provided data? Have they never used prepared statements before?
Re: Fuzzing Go APIs for SQL Injection
#4People are still constructing SQL statements using user provided data? Have they never used prepared statements before?
It's much more common than you may think - especially at larger organizations where engineers go "off-script" frequently.
That being said, we wanted to highlight an example of how fuzzing can be applied to a typical (albeit, toy) API to find logic bugs, and figured SQL Injection would be something that resonated with most (all?) developers.
Re: Fuzzing Go APIs for SQL Injection
#5A lot of folks we talk to think fuzzing is only useful for finding memory leaks in C++ programs, so we wanted to show how adding a single fuzz test to your API can find SQL injection and other logic bugs. Would love to hear others' experience with Go fuzzing now that it's been out for a few months.
Fuzzing network protocol is a good usecase.
Re: Fuzzing Go APIs for SQL Injection
#6People are still constructing SQL statements using user provided data? Have they never used prepared statements before?
The problem I run into at work is developers learn ORMs in many situations before they learn SQL itself. As a result, many are used to ORMs which can do this for them via parameterization or they simply were never exposed to them. Whether it’s good or bad, right or wrong, we’ve found that ensuring certain concepts are shared across all developers via a team onboarding training trumps the inconvenience when they already know these.
Re: Fuzzing Go APIs for SQL Injection
#7Is there a open source fuzzing framework for Go?
Re: Fuzzing Go APIs for SQL Injection
#8People are still constructing SQL statements using user provided data? Have they never used prepared statements before?
Yes, it feels dated since JDBC brought prepared statements into the mainstream literally decades ago. Though I have seen this still happening from marketing hiring external marketing agencies to write some small apps for them, e.g. a web game for grabbing email addresses. Hopefully they don't have access to your main database (though I have seen this in startups too, because fast,fast,fast).
Re: Fuzzing Go APIs for SQL Injection
#9Is there a open source fuzzing framework for Go?
As of go 1.18, fuzzing is built into the toolchain itself, and is what we're using in this post.
We go over the basics here [0], if you'd like to start at the beginning
Re: Fuzzing Go APIs for SQL Injection
#10Is there a open source fuzzing framework for Go?
As of go 1.18, fuzzing is built into the toolchain itself, and is what we're using in this post. We go over the basics here [0], if you'd like to start at the beginning [0]: https://blog.fuzzbuzz.io/go-fuzzing-basics/
Great, will take a look!