For any IPv4/IPv6 target, Penzzer offers three top-level test methods: protocol-aware fuzzing (below), general network penetration testing (vulnerability/misconfiguration scanning), and a standalone port scanner.
106 protocol targets are available for protocol-aware fuzzing, listed below by IP address family.
For these, Penzzer is the side that listens and the target under test connects to it, which is how a client implementation is fuzzed rather than a server one.
Parsed with a format grammar, so fuzzing targets real fields rather than random offsets.
Note: the two document/data formats are fuzzed by generating documents rather than by parsing a grammar, which is why they are listed apart from the binary formats above. A CSV run varies the content of an otherwise valid table - duplicate header rows, digits replaced by lookalike characters drawn from a single writing system, Unicode spaces, injected and duplicated columns, absent cells, padding - and in half of the files it sends it also breaks the file's structure, in one of 19 ways: an unbalanced quote, a ragged row, a second table in one file, a raw delimiter in an unquoted field, a UTF-8 BOM, a UTF-16 or deliberately invalid encoding, a NUL byte, a lone-CR terminator, an alternate delimiter. Three further shapes carrying oversized fields are available on request. A PDF run mutates a corpus of base documents at the object level, at the structure level, and at the byte level, 10 strategies in all.
Note: EXIF and embedded ICC color profiles are also parsed and fuzzed, but as nested structures within JPEG/PNG/TIFF rather than as standalone selectable targets.
Note: DICOM, HL7v2, and FHIR are healthcare data standards, but are fuzzed as network protocols (client/server traffic) rather than as static files - see Network Protocols above. Similarly, DBC (CAN signal database format) is used to drive protocol-aware CAN bus fuzzing rather than being fuzzed as a standalone file - see CAN / Automotive Protocol Coverage below.
A curated library of targeted proof-of-concept attacks, grouped below by protocol/target family. Each entry is a distinct test technique.
6LoWPAN
Zep encapsulated frame abuse
802.1AE IEEE MAC Security standard
Mka peer list flood, Plaintext bypass, Pn replay abuse, Sectag field abuse
802.1X (EAPOL)
EAP failure spoofing, EAPOL logoff spoofing, EAPOL start flood, Preauth bypass
ARP
Address conflict defence, Cache poisoning, Excessive dpdu length, Hardware address spoofing, Incorrect specified lengths for address fields, Invalid operation, Translation cache size
Border Gateway Protocol
Connection exhaustion, Malformed header, Malformed update attributes, Open field abuse, Out of context messages, Truncated messages, Undefined message types
CAPWAP
Cleartext control bypass, Discovery request flood, Fragment reassembly abuse, Malformed header fields, Message element length abuse, Truncated packets, Undefined message types
CDP
Neighbor table flood
CWMP
Command injection rpc, Connection request probe, Http header abuse, Malformed soap envelope, Oversized rpc fields, Undefined rpc methods, Xml entity expansion
DHCP
Client FQDN and hostname injection, Discover flood, Hlen and chaddr bounds, Option TLV walk abuse, Per message resource leak, Release spoofing, Reply builder field residue, Rogue offer spoofing, Short datagram field reads, Unterminated sname and file fields
Diameter
Peer connection handling and capabilities exchange
DMAP
Metadata element abuse
DNS
Compression pointer loops, Cross query buffer reuse, EDNS option accounting, Oversized datagram stall, Per query allocation growth, QNAME label walk bounds, Question echo integrity, RDLENGTH and record bounds, Section count mismatch, Type bitmap decoding cost, What the cache key leaves out
DoH
Entry point parity with the DNS listeners
dTLS
Clienthello field abuse, Clienthello flood, Cookie exchange abuse, Handshake fragment abuse, Record content type abuse, Truncated records, Version field abuse
ENIP
Multiple service packet expansion
EtherCAT
Datagram chain abuse, Datagram length mismatch, Register write abuse, State change broadcast flood, Truncated frames, Type field abuse, Undefined commands
Ethernet
Broadcast destination address tolerance, Jumbo frame tolerance, Multicast destination address tolerance, Protocol address spoofing, Runt frame tolerance, Truncated dpdu, Unicast destination address tolerance
FTP
Command argument overflow, Command stall, Data channel origin hijack, Data channel resource exhaustion, Listener accept reset, Path containment escape, PORT and EPRT argument abuse, Quadratic argument parsing, Reply and command framing abuse, Unbounded control line
GLBP
Avg hijack
Hot Standby Router Protocol (HSRP)
Hijack
HTTP
Chunked framing abuse, Per request leak, Quadratic field parsing, Request line and header bounds, Trailer section abuse, Unbounded start line and header section
HTTP2
HPACK table and header abuse
ICMPv4
Malformed pdus of defined pdu types, Pdus of appropriate pdu type but with invalid field content, Pdus of contextually inappropriate pdu type, Ping of death, Processing of npdus that reference undefined or supposedly nonimplemented protocol types, Redirect spoofing, Rejection of IP multicasts and broadcasts, Rejection of npdus with invalid source IP addresses, Undefined pdu types
Internet Group Management Protocol v1/v2
Bad checksum handling, Contextually inappropriate pdu type, Malformed pdus of defined pdu types, Max resp code floating point boundaries, Membership report flood, Missing router alert option, Non multicast or spoofed source, Pdus with invalid field content, Query leave race flood, Truncated pdu truncated fixed header, TTL not one, Undefined pdu types, Version confusion
Internet Group Management Protocol v3
Query qrv qqic extremes, Query source count mismatch, Report aux data len abuse, Report group record count mismatch, Source list state exhaustion
IPv4
Bad checksum flood to exhaust stateful firewalls, Checksum iteration count underflow, Fragment declared length underflow, Illogical or inconsistent npdu flag values, Invalid npdu header IP version, Npdu fragment mis reassembly, Npdu options, Receipt of npdus with various ttl field values, Truncated fixed header, Truncated header options
IS-IS
PDU length bounds
Lightweight Access Point Protocol (LWAPP)
Discovery request flood, Fragment reassembly abuse, Malformed header fields, Message element length abuse, Session id abuse, Truncated packets, Undefined message types
Link Layer Discovery Protocol (LLDP)
Chassis port id subtype abuse, Missing or reordered mandatory tlvs, Neighbor table exhaustion, Oversized tlv values, Tlv length mismatch, Truncated lldpdu, TTL and end of lldpdu abuse, Undefined tlv types
LwM2M
Block transfer reassembly
MACControl
Malformed truncated frames, Pause flood, Pause time boundary values, Pfc class enable vector abuse, Undefined opcodes, Wrong destination
mDNS
Name decompression loops, Record count and RDLENGTH bounds, Reply amplification and probe conflict, Reply suppression above the output size, Short datagram header reads, Unsolicited announce injection
Message Queuing Telemetry Transport
Anonymous access check, Connection exhaustion, Control API access, Credential brute force, Declared length retention, Malformed connect packets, Remaining length abuse, String length abuse, Subscription table growth, Topic depth and length, Truncated packets, Undefined control packet types, Username probe timing, Wildcard subscription abuse
Modbus
Connection exhaustion, Diagnostics and device id abuse, Illegal function codes, Length field mismatch, Mbap header abuse, Per connection state reuse, Read request field abuse, Truncated adu, Write request field abuse
NAT
Conntrack exhaustion TCP syn, Conntrack exhaustion udp, Icmp id table exhaustion, Pat port exhaustion, Source IP sweep exhaustion, State timer churn
NAT-PMP
Epoch consistency across the version-error path, Mapping deletion cost
NetBIOS
Name decoder bounds
NETCONF
Message framing abuse
OPC UA
Array count allocation
Open Shortest Path First (OSPF)
Designated Router election abuse, Link state database poisoning, LSA count and length bounds, Messages from an unknown neighbour, Opaque LSA sub-TLV bounds, Post-adjacency message bounds
P2P
Overlay control message abuse, Rendezvous message field abuse
PIDF
Presence document merge
Port Control Protocol (PCP)
Malformed map fields, Map request flood, Option abuse, Third party spoofing, Truncated packets, Undefined opcodes, Version field abuse
Port Security
MAC flood
Precision Time Protocol (PTPv2)
Announce grandmaster takeover, Correction field boundary abuse, Delay request flood, Malformed pdus of defined message types, Management message abuse, Message length field mismatch, Sync spoofing flood, Truncated common header, Undefined message types, Version field abuse
PROFINET
Acyclic record write and read back, Connect block table bounds, Cyclic data frame offsets, DCP block and option bounds, Ethernet demux and VLAN tag walk, Implicit read index handling, Receive buffer residue in replies, Remote call session exhaustion, Scanner capture thread abort, Scanner connect record export, Scanner station name handling
Protocol Independent Multicast
Bootstrap rendezvous-point count mismatch, Bootstrap rendezvous-point set state exhaustion, Candidate rendezvous-point prefix count mismatch, Encoded address mask length bounds, Join source count state exhaustion, Rendezvous-point holdtime that never expires, Truncated pdus of defined message types, Undefined pdu types and versions
PROXY protocol
Header segmentation
RADIUS
Access request flood, Attribute length abuse, Length field mismatch, Malformed pdus of defined codes, Message authenticator abuse, Shared secret brute force, Truncated packets, Undefined codes
RFB
Message length fields, Pseudo encoding dimension wrap, Rect decoder bounds, Security handshake abuse
RIP
Authentication field abuse, Malformed response entries, Oversized entry count, Request table flood, Route injection, Truncated packets, Undefined commands, Version field abuse
RTCP
Report count and compound packet bounds
RTMP
Chunk stream and command object bounds
RTP
Header and extension bounds
RTSP
Request and transport header abuse
SCTP
Bundled chunk length overrun, Chunk length below minimum, Chunk length mismatch, Truncated chunks of defined types, Truncated common header
SDP
Media description field abuse
SDP-HTTP
Offer and answer field abuse
SIP
Content length wrap, Digest and base64 field abuse, Header parse amplification, MIME multipart body abuse, Per message allocation growth, URL parse abuse
SNMP
BER length field abuse, Community string brute force, Cross datagram state reuse, GetBulk repetition abuse, Nested sequence depth, OID arc count and subid encoding, Oversized varbind value, Reply amplification and tooBig, Request id and error index echo, TCP transport framing, Trap spoofing, Unauthorized write abuse, v3 USM field abuse, Varbind list structure abuse
SOCKS5
Association origin and listener bounds
SSDP
Search and notify field abuse, Socket and state growth
SSH
Connection exhaustion, Diffie-Hellman group and public value abuse, KEXINIT field abuse, Out of context messages, Packet length abuse, Truncated packets, Undefined message types, Version banner abuse, Weak algorithm negotiation
STP
Root bridge takeover, Topology change flood
STUN
Attribute count amplification, Attribute length and padding abuse, Channel data framing abuse, Log and reply amplification, Message integrity and fingerprint abuse, TURN allocation and permission abuse, Unauthenticated state table growth
TCPv4
Established segment validation, Half open reset acceptance, Initial sequence number leak, IPv4 option request socket race, Land and latierra attacks, Malformed or undefined tpdu options, Out of order segment retention, Spoofed TCP flags, Truncated tpdu truncated fixed header, Truncated tpdu truncated header options, Truncated tpdu truncated priority data, Unrestricted interpretation of select tpdu options, Zero length option walk
Telnet
Connection exhaustion, Credential brute force, Encrypt keyid overflow, Environ option injection, Iac command abuse, Option negotiation abuse, Subnegotiation abuse, Unbounded input line
TFTP
Cross request state reuse, Data ACK block abuse, Long filename and mode overflow, Option negotiation abuse, Path traversal, Request flood resource exhaustion, Rrq wrq field abuse, Transfer identifier injection, Truncated packets, Undefined and malformed opcodes, Worker and accept starvation
TLS
Certificate whose private key is a small number, SNI wildcard backtracking
UDPv4
Rejection of tpdus addressed to reserved destination ports, Tpdu length signedness, Truncated tpdu header with negative length field, Truncated tpdu header with non negative length field, Valid tpdu shorter than IP npdu payload
UPnP
Content length and chunk framing, GENA subscription abuse, Header count and lookup amplification, Media path and segment abuse, Request target and SSRF, Search argument amplification, SOAP body and XXE abuse, Unauthenticated control write
Virtual Router Redundancy Protocol (VRRP)
Hijack
VLAN
Deep tag nesting, Double tagging hopping, Id boundary and reserved values, Priority and dei abuse, Tpid variations, Truncated tag
WebSocket
Fragmentation and control frame abuse, Frame header and length abuse, Unbounded message stream, Upgrade handshake abuse
XML
Entity and cursor recursion
XMLRPC
Method call and body abuse
Border Gateway Protocol
Connection exhaustion
CAPWAP
Discovery request flood
DHCPv6
Client identifier handling, IA option count and hint abuse, Option count and request list cost, Reconfigure spoofing, Reply and forward builder bounds, Rogue advertise spoofing, Solicit flood
Diameter
Peer connection handling and capabilities exchange
DMAP
Metadata element abuse
DNS
Oversized datagram stall, Per query allocation growth, Question echo integrity, Type bitmap decoding cost
DoH
Entry point parity with the DNS listeners
dTLS
Clienthello flood
FTP
Command argument overflow, Command stall, Data channel origin hijack, Data channel resource exhaustion, Listener accept reset, Path containment escape, Quadratic argument parsing, Reply and command framing abuse, Unbounded control line
HTTP
Chunked framing abuse, Per request leak, Quadratic field parsing, Request line and header bounds, Trailer section abuse, Unbounded start line and header section
HTTP2
HPACK table and header abuse
ICMPv6
Destination unreachable spoofing, Echo request flood, Packet too big spoofing, Parameter problem spoofing
IPv6
Duplicate address detection dos, Fragment identification key and retention, Fragmentation null reference, Fragmentation overlap, Hop by hop unrecognized option abuse, Incomplete fragmentation, Multicast ping, Multicast udp ping, Multiple nesting, ND encapsulated sub-option walk, Neighbor advertisement spoofing, Neighbor cache exhaustion, Neighbour discovery field validation, Ra guard evasion, Ra rdnss spoofing, Redirect spoofing, Rogue router advertisement, Router advertisement dos, Router advertisement kill, Router advertisement option bounds, Router solicitation handling, Routing header type0 amplification, Rpl nesting, Truncated fixed header, Truncated options
mDNS
Reply amplification and probe conflict
Message Queuing Telemetry Transport
Connection exhaustion, Control API access, Declared length retention, Subscription table growth, Topic depth and length, Wildcard subscription abuse
MLD
Hop limit not one, Missing router alert option, Multicast listener report flood
MLDv2
Query source count mismatch, Report aux data len abuse, Report multicast record count mismatch
Modbus
Connection exhaustion, Diagnostics and device id abuse, Illegal function codes, Length field mismatch, Mbap header abuse, Per connection state reuse, Read request field abuse, Truncated adu, Write request field abuse
NETCONF
Message framing abuse
OSPFv3
Link LSA next-hop sequence, Link-local signalling TLV bounds
P2P
Overlay control message abuse, Rendezvous message field abuse
Port Control Protocol (PCP)
Map request flood
RADIUS
Access request flood
RFB
Message length fields, Pseudo encoding dimension wrap, Rect decoder bounds, Security handshake abuse
RIPng
Prefix length abuse, Request table flood, Route injection, Truncated packets, Undefined commands
RPL
Decreased rank attack, Dis flood, Version number attack
RTMP
Chunk stream and command object bounds
RTSP
Request and transport header abuse
SDP-HTTP
Offer and answer field abuse
SNMP
BER length field abuse, Community string brute force, Cross datagram state reuse, GetBulk repetition abuse, Nested sequence depth, OID arc count and subid encoding, Oversized varbind value, Reply amplification and tooBig, Request id and error index echo, TCP transport framing, Unauthorized write abuse, v3 USM field abuse, Varbind list structure abuse
SOCKS5
Association origin and listener bounds
SSH
Connection exhaustion
Telnet
Connection exhaustion, Credential brute force, Encrypt keyid overflow, Environ option injection, Iac command abuse, Option negotiation abuse, Subnegotiation abuse, Unbounded input line
TFTP
Cross request state reuse, Data ACK block abuse, Long filename and mode overflow, Option negotiation abuse, Path traversal, Request flood resource exhaustion, Rrq wrq field abuse, Transfer identifier injection, Truncated packets, Undefined and malformed opcodes, Worker and accept starvation
TLS
Certificate whose private key is a small number, SNI wildcard backtracking
UPnP
Content length and chunk framing, GENA subscription abuse, Header count and lookup amplification, Media path and segment abuse, Request target and SSRF, Search argument amplification, SOAP body and XXE abuse, Unauthenticated control write
WebSocket
Fragmentation and control frame abuse, Frame header and length abuse, Unbounded message stream, Upgrade handshake abuse
XML
Entity and cursor recursion
XMLRPC
Method call and body abuse
Cherokee kill brakes, Cherokee kill engine, Cherokee turn steering, Diagnostic state, ECU hard reset, Ford escape diagnostic packets, Ford escape door ajarSpoof, Ford escape kill engine, GPS manipulation, Honda car lock and unlock, Ignis zeta fuel seatbelt spoof, Janus attack, Jeep wrangler evicsend, Kill bus, Malibu overheat, Mazda IC mover, Mazda2 IC fuzzer, PDO input output controller, Peugeot207 IC fuzzer, Peugeot207 IC mover, Peugeot207 IC reboot, Peugeot207 IC warning, Prius park killEngine, Reset mileage, Rx8 RPM fuzzer, Spam bus, Tesla disable ESP ABS, Tesla open trunk, UDS sec access, Wiper override
L2CAP
Echo response residue, Signalling length bounds
SDP
Attribute identifier list validation, Attribute list walk termination, Continuation state read past the declared parameters
The same library again, grouped by the kind of code-quality defect each test was written to provoke rather than by the protocol it speaks. A test is written from a defect shape - a read past the end of an allocation, a command honoured without authentication, a value accepted where the specification requires a refusal - and that shape is recorded on the test itself, so a report can say what kinds of defect a run looked for as well as which protocols it covered.
This is a property of the tests, not a claim about any product: the counts below are the same whether a run finds nothing or finds twenty. What a finding reports about a target is a separate statement, and is bounded by what the test could actually observe - a test written from a memory-safety defect reports what crossed the wire, and names memory safety as what it was aimed at rather than as what it proved.
memory safety - 104 modules
An access outside the bounds of an allocation, or of freed memory. Claimed only where a sanitiser, a fault signal or returned bytes that were never sent witness it.
information disclosure - 15 modules
Data the requester was not entitled to, reaching the requester: residue from an earlier request, uninitialised memory, or internal detail in a diagnostic.
resource exhaustion - 77 modules
Memory, storage or table entries consumed out of proportion to the input, or retained after it has been answered.
availability - 22 modules
The target stopped serving: it answered, and then did not, or it restarted.
hang or algorithmic complexity - 21 modules
Work that does not finish, or that grows far faster than the input it is driven by.
input validation - 122 modules
A value accepted that the protocol or format requires to be refused, including a declared length or count that disagrees with what follows it.
protocol state logic - 94 modules
An operation honoured in a state that does not permit it, or without the authentication or sequence the protocol requires.
type and format handling - 10 modules
A field whose declared type or range is violated and accepted - a number where a date belongs, a value past the maximum its encoding allows.
error handling - 2 modules
A failure handled wrongly: dropped in silence where a refusal is required, or answered with the wrong status.
undefined behaviour - 1 module
An operation whose result the language does not define, such as a shift of a negative value or a signed overflow.
not yet classified - 1 module
Tests whose defect shape has not been read and recorded. Counted here rather than dropped, so the totals above are not overstated.
Total: 469 attack modules.
Beyond the curated vehicle attacks above, Penzzer supports protocol-aware fuzzing across the automotive stack:
Supported as standalone fuzzing targets, outside the INET4/INET6/CAN attack-module library:
GATT/ATT operations targeted at a BLE peripheral: MTU exchange, all read variants (by handle, by type, by group type, blob, multiple handles), all write variants (request, command, queued prepare/execute write), handle/UUID discovery (Find Information, Find By Type Value), and server-initiated notifications/indications. Error-response handling is fuzzed across all of the above.
Pairing is fuzzed separately, on the Security Manager (SMP) channel rather than the attribute one. A peripheral is required to accept a pairing request from an unpaired, unauthenticated peer, so this surface is reachable with nothing but a link: the negotiated encryption key size is driven across and outside the 7-to-16-octet range the specification permits, reserved values are put in each of the fields that select a pairing method (input/output capability, out-of-band flag, key distribution), an elliptic-curve public key that is not on the curve is offered, a confirm value is sent before the response it belongs after, a security request is sent from the wrong role, and undefined command codes are sent. Every case is the opening message of an exchange, so none of them depends on a prior bond. Two rules the specification fixes absolutely are checked in the answers - that a key size outside the permitted range must never be agreed to, and that a refusal carries a reason code the specification allows for the request it answers - and because those need no baseline for the device, neither can be confused by an unfamiliar peripheral. A run bounds the number of pairing attempts it makes, since repeated failures trip lockouts on real devices.
Stateful fuzzing of L2CAP connection-oriented channels (connect, configure, disconnect, channel move), including the signalling header's own declared length set against the command that follows it and against the value at which a receiver subtracting its header makes no progress at all, and configuration option lists that end short of a whole option. Plus the profiles/protocols conventionally layered on top:
Beside the corpus walk above, Bluetooth penetration testing runs a chosen set of named attacks against one device. Each reproduces a specific defect shape observed in a shipping Bluetooth stack rather than walking a field's range, so a run answers "does this device have this defect" rather than "did anything here look odd", and reports the defect by name. Every attack available today works on a surface that needs NO PAIRING and is therefore reachable by any device in radio range.
Three are on the service discovery protocol: an attribute identifier list carrying element types and widths the specification does not permit there, where the accept-or-refuse decision is itself the signal; a pair of requests whose declared parameters are byte-identical and which differ only in the octets after them, compared against a matched control pair so that a device whose answers vary for its own reasons is not reported; and an element header that a walk advancing only on the headers it recognises never gets past, which can leave a device needing a power cycle.
Two are on the L2CAP signalling channel, which is live as soon as there is a link and is the most exposed surface a Classic device has. The first sends commands whose declared length is not the length of what arrived - the value at which a receiver subtracting its own four-octet header makes no progress, values below those four octets so the subtraction underflows, and an option list ending part-way into a second option, with a complete option as the control. The second asks the device to echo a few octets while declaring many more: the specification requires the data to be echoed, so a reply carrying more than was sent was sized from the number in the request rather than from what arrived, and the extra octets are whatever lay after it in the device's own receive buffer.
Both are judged against an L2CAP Echo Request, which every Classic device is required to answer on that same channel. Being mandatory and conforming, it measures the device rather than the surface under test: a device that answered one before a case and answers none after it has stopped serving, confirmed on a freshly opened link so that a stack tearing down a connection is not reported as a hang. A run whose baseline echo fails reports that it tested nothing rather than that the device is clean.
Where an attack can stop a device - which is the question two of them ask rather than a side effect - the run ends at the first case that does it and names the cases it did not reach, rather than reporting them as a device that refused them.
Penzzer acts as a rogue/test access point against client devices, covering the full 802.11 management frame set: probe request/response, beacon, authentication, association/reassociation, disassociation, deauthentication, and action frames. Also covers open networks and WEP, WPA2 (4-way EAPOL-Key handshake, CCMP), and WPA3 (SAE handshake) security modes.
The inverse of AP mode: Penzzer acts as a rogue/test client against access points, covering the same frame set from the client side (probe, beacon, authentication, association/disassociation, deauthentication) plus EAP/EAPOL exchanges.
Full USB control-transfer (endpoint 0) fuzzing: all request types (standard, class, vendor, reserved), all recipients (device, interface, endpoint, other), both transfer directions, the complete request-code range, and the value/index/length fields - i.e. comprehensive coverage of a device's control-endpoint request handling, independent of device class.
Modbus RTU over serial: every public function code - the bit and register reads (read coils, read discrete inputs, read holding/input registers), the writes (write single coil, write single register, write multiple coils, write multiple registers, mask write register, read/write multiple registers), the serial-line diagnostics (read exception status, diagnostics, get comm event counter, get comm event log, report server ID), file record access (read/write file record), read FIFO queue, and read device identification over the encapsulated interface transport. Each is fuzzed with bit-flip, truncation, garbage insertion and byte-swap mutation of the request, illegal function code and address injection, and frame-level mutation of the RTU envelope itself: a corrupted CRC, a byte-swapped CRC, a frame truncated below the 4-byte minimum, and a frame padded past the 256-byte maximum. Frame timing follows the standard's character-time rules at the configured baud rate rather than fixed delays, so a device is not misjudged for our own framing.
Modbus ASCII over serial carries the same function codes - it is the second transmission mode of the same standard and the same application layer - with the framing fuzzed in its own terms: a corrupted longitudinal redundancy check, hexadecimal spelled in lower case where the standard requires upper, an odd number of hexadecimal characters so the frame cannot decode to whole octets at all, a missing start character, and a frame left without its terminator. A reply is judged through the three gates the mode adds before a message exists - the start character, an even count of hexadecimal characters, and the check digit - each reported separately, so a device that accepts one of them wrongly is distinguished from one that accepts another.
NMEA 0183: the common sentence set a receiver has to parse - recommended minimum data, fix data, active satellites, satellites in view, track and ground speed, geographic position, date and time - together with a proprietary sentence whose format no receiver knows and a query sentence carrying no data fields at all. These are chosen for the shapes a parser has to survive rather than for any one talker: empty fields, single-character fields, a declared sentence count a receiver reassembles across, and fields added by later revisions of the standard. The sentence framing is fuzzed in its own terms - a corrupted checksum, a missing start delimiter, a sentence padded past the 82-character maximum, and a sentence left unterminated - and the talker identifier is replaced to produce a well-formed sentence of a type nothing implements. NMEA is a broadcast protocol: a talker sends and a listener is not expected to answer, so every case is delivered and none is scored, and a run says so rather than reporting a quiet listener as a clean result.
Targeted at HTTP(S)-based applications and services, independent of the protocol-level HTTP/1.1 fuzzing listed under Network Protocols:
Each of these reports defects found in third-party implementations, using the targets and attack modules listed above.
Identify security flaws before attackers do, automatically and at scale with Penzzer's intelligent fuzzing engine.
Unified Automotive and IoT Security Testing Tool
Accelerate Vulnerability Detection with Pen Testing and Dynamic Fuzzing
Find and fix vulnerabilities fast, only Penzzer unifies pen testing and dynamic fuzzing to meet compliance standards
Uncover hidden vulnerabilities in your IoT/automotive systems 5x faster than manual testing.