akde/infosec

Information security is ultimately about managing risk

Fuzzing

,

From SANS660: “Fuzzing is not an attack; it is a fault-test­ing tech­nique.” Types are:

  • Instru­ment­ed Fuzzing: “Mon­i­tor­ing” a sys­tem to learn how nor­mal inputs look like. No pre-knowl­edge of the sys­tem needed.
  • Intel­li­gent uta­tion: A pro­to­col gram­mar which defines paths through all the code. Inputs are mutat­ed accord­ing to the grammar.

Tools

Sulley

A Frame­work to describe a pro­to­col which then can cre­ate pro­to­col muta­tions and tests a sys­tem against it. (You can cre­ate a fuzzer with it.)

Instal­la­tion:

  • git clone https://github.com/OpenRCE/sulley && cd sul­ley && python setup.py install
  • Don’t use pip or you will prob­a­bly install anoth­er project with the same name!

Boofuzz

Boo­fuzz is a fork from the not-longer main­tained Sul­ley project.

Notes

  • Have Wire­shark enabled. Maybe some­thing can be seen in the data stream. Also, Wire­shark has pro­to­col dis­sec­tor to guess protocols.
  • Appli­ca­tion fuzzing
    • Start the appli­ca­tion with­out parameters.
    • Start the appli­ca­tion with var­i­ous non-exist­ing parameters.
    • Try ltrace
    • Try strace
    • Try ldd
    • Use strings to see some­thing unique
  • Para­me­ter fuzzing:

See also

Leave a Reply

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';