Fuzzing, also known as fuzz testing, is a dynamic application security testing (DAST) methodology. It involves providing a program with invalid, malformed, unexpected, or random data as inputs to identify security vulnerabilities and defects. The primary goal is to trigger crashes, memory leaks, unhandled exceptions, or other anomalous behaviors that could indicate a potential security flaw. This process automates the discovery of bugs that might be missed by manual code inspection or other testing methods, effectively "stressing" the application's input validation and error-handling routines. The description provided in the question is the textbook definition of fuzzing.

A. Reverse engineering: This is the process of deconstructing a compiled program to understand its functionality and design; it does not involve testing the application with live data inputs.
B. Static: This refers to Static Application Security Testing (SAST), which analyzes an application's source code or binaries for vulnerabilities without executing the program.
D. Debugging: This is the process of identifying, analyzing, and removing defects (bugs) from software. While fuzzing helps find bugs, debugging is the subsequent act of fixing them.

1. Manès

V. J. M.

Han

H. S.

Han

C.

Cha

S. K.

Egele

M.

Schwartz

E. J.

& Woo

M. (2019). The Art

Science

and Engineering of Fuzzing: A Survey. IEEE Transactions on Software Engineering

47(11)

2312-2331. In Section I (Introduction)

the paper defines fuzzing as a technique that "works by sending a large number of inputs to a target program in the hope of triggering a crash." https://doi.org/10.1109/TSE.2019.2946529

2. Godefroid

P.

Levin

M. Y.

& Molnar

D. (2012). SAGE: whitebox fuzzing for security testing. Queue

10(1)

20-27. The article's introduction defines fuzz testing as "a software testing technique that consists of finding implementation bugs using malformed/semi-malformed data injection in an automated fashion." https://doi.org/10.1145/2090147.2094081

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Fall 2014. Lecture 7: Software security: fuzzing

bug-finding

and program analysis. The lecture notes define the core idea of fuzzing as: "throw lots of random inputs at a program

see if it crashes." This aligns with the question's description of using random data to detect crashes.

4. Zalewski

M. (2007). Cross-Site Scripting - The new fuzzer in town. In Black Hat Briefings. This presentation

from a leading security researcher and often cited in academic contexts

describes fuzzing as a method of identifying bugs by "feeding a program with semi-random

deliberately mangled data." (Slide 4).