I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax:
STRU [<SP> F|R|P] <CRLF>
I tried to specify the optional F,R,P arguments to the STRU command like the following:
s_initialize('DataSTRU') s_static('STRU ') s_group('struv', values=['F', 'R', 'P']) s_block_start('strub', group='struv') s_block_end() s_repeat('strub', min_reps=0, max_reps=1, fuzzable=True) s_static('\r\n')
This sends the right commands to the FTP server (STRU F; STRU R; STRU P), but the problem is that is it. It doesn't try to omit the character or fuzz it, which I would also like. I know I can just specify the argument to fuzz, but I would like to fuzz the argument as well as mutate the valid arguments. Any ideas how to apply the optional+fuzzable argument to the above code?
Another problem is that I don't know how can I check which command is currently being used - I'm using the commands inside s_block_start and I'm iterating through the s_group element like the following:
s_initialize('DataSet') s_group('commands', values=['MODE', 'PROT', 'STRU']) s_block_start('DataBlock', group='commands') s_delim(' ') // TODO: how to check whether: // if [current_command == 'MODE'] do this // elif [current_command == 'PROT'] do this // else [current_command == 'STRU'] do this s_static('\r\n') s_block_end()
That's it. Any ideas and recommendations are welcome. Thanks