Hot answers tagged fuzzing
27
What is the purpose of a fuzzer?
A fuzzer tries to elicit an unexpected reaction from the target software by providing input that wasn't properly planned for. It does this by throwing "creatively constructed" data as input to software. Expecting a phone number? Ha! I'm going to give you 1,024 characters of 0x00! Random hex! Unicode! A zero-width field! ...
17
A fuzzer is a (semi-)automated tool that is used for finding vulnerabilities in software which may be exploitable by an attacker. The benefits include, but are not limited to:
Accuracy - A fuzzer will perform checks that an unaided human might miss
Precision - A fuzzer provides a kind of benchmark against which software can be tested
Speed - A fuzzer may ...
11
The basic path for exploiting an overflow-related vulnerability is to find a crash (often by fuzzing), evaluate the crash and whether it presents an attack path, and then build something to exploit it.
Sometimes where one looks can involve knowledge of the architecture, such as when Charlie Miller noted that iOS 4.3 has a section of memory which will run ...
8
To look at your assumptions:
many attack groups have resources vastly bigger than that of companies
in a typical company security is a cost centre, so they never have enough staff or money
in the black hat world, finding security flaws is a revenue stream
fuzzing is done by security engineers and black hats
fuzzing is by its very nature fallible. So ...
8
Responses from a network service should fall into one of a few well defined and broad categories. If you send random data to, for example, an HTTP service, you expect to get back a lot of HTTP 400 results and perhaps a few other HTTP 4XX results. If anything ELSE happens, such as a timeout or a different response, then that anomalous result is worth noting ...
6
from what I understand, they just send tons of random data at
different services and observe their reaction to it
This is partly true, depending on what you mean by "random". Fuzzers can be used that way for the purpose of identifying memory leaks in a program, but they can also be useful in pen-testing (by making the program crash). If you can crash ...
6
It sounds like you are confusing your work environment with your target environment.
Which OS should you work from? There are far more useful tools in Linux than in Windows. Use Linux (or even a penetration testing distro like Backtrack) as a work environment. If you say that you could roll your own security tools (and why would you when there is a ...
5
ASLR is a broad term that encompases many different protections and techniques.
In general, basic forms of ASLR (eg stack randomisation) are used to make development of exploits harder or impossible - but do not prevent the triggering of the bug and a crash of an application. Fuzzing should work the same with aslr enabled or not.
5
I like using the peach fuzzing platform. This contains a testing harness which will record memorydumps from crashes and link them to the fuzz test case. When the process crashes, the testing harness will restart it and continue until testing is complete.
As far as I know !exploitable is pretty unique. Valgrind is useful at determining flaws like ...
5
I don't have numbers for you, or specific guidelines, but I think an important issue to point out, but was not sufficiently emphasized in those links, is Code Coverage.
It makes little sense to run a huge number of fuzz iterations, if they are all similar - from a code path point of view.
That is, "dumb fuzzing" may generate many different inputs ...
5
Updated answer: If you are using Windows, try the CERT Failure Observation Engine (FOE). It is a fuzzing framework for Windows. It has the ability to do file-based fuzzing, to click on dialog boxes, and other stuff.
Previous answer:
I suggest you start with zzuf. It is the simplest, easiest to use command-line fuzzer for fuzzing standalone programs ...
4
The short answer is: no.
Here the long answer: The origin of fuzzing (or fuzz testing) is sending random data or slightly random data (i.e. sticking to a certain format or mutating something valid).
The goal of fuzzing is usually to provoke an application crash. This crash can then be analyzed with debuggers or memory monitoring tools (i.e. Valgrind) to ...
4
You have the pen-test laptop and the fuzzing server.
Pen-test laptop is typically an HP dm1z with 8GB of RAM running Win7 with VMware Workstation 8.0.1 with BackTrack 5R1 and potentially other Linux/BSD VMs. You can even run Mac OS X Snow Leopard and Lion in separate VMs using iBoot/Multibeast/Unibeast. Use of 2 ALFA USB WiFi AWUS036Hs via HakShop would be ...
4
Since both of your questions relate to groups, we should look at how they're used first. The purpose is to bind block data to a set of static values -- sulley iterates through the list of values and generates block data for each one.
The example in the docs uses HTTP, where the block data is a simple HTTP request and the group values are HTTP verbs ('GET', ...
4
Here's the best heuristic I know of. Run the program under Valgrind memcheck, and then look at the warnings that Valgrind outputs. We can classify them into a couple of categories:
Invalid write: Look at the address. If the address is small (say, between 0x0 to 0xFFF, say), then this is a NULL pointer dereference: probably not exploitable, low priority. ...
3
No one suggested a definitive answer, so I ran a tiny experiment. Based up on this experiment, here is my recommendation so far:
Recommendation. When fuzzing, you might consider setting the environment variables LIBC_FATAL_STDERR_=1 MALLOC_CHECK_=3. This setting had no measurable performance impact in my experiment, and based upon my results, this setting ...
3
If an application is going to crash from a test, a compiler option isn't going to save it. If your compile the application with gcc -D_FORTIFY_SOURCE=2 -O2 then the process will killed off more often due to minor memory infractions that wouldn't normally crash the process. A good example of this is that you will have an increased ability to detect ...
3
What an interesting question. I gather it's unix only, but if it's not, the first thing I'd recommend is testing it in both environments. Windows has a really good set of tools for doing heap debugging, dangerous api management, and so on - google App Verifier if you're interested.
But in general, I'd say you should at the least try a release build, with ...
3
I once built one of these rigs for Electronic Arts to handle online-game traffic simulations to ensure the best possible user experience despite network conditions.
The free option was NIST Net from the National Institute of Standards and Technology (NIST). Based on Linux, free, complex and limited, but might be just what your looking for.
The expensive, ...
3
CERT's open source Linux Triage Tools can be used for triage of bugs found via fuzzing. The tools include a GDB extension that is similar to MSEC's !exploitable, but for Linux.
http://www.cert.org/blogs/certcc/2012/04/cert_triage_tools_10.html
2
Off the top of my head, I don't think aslr will matter much one way or the other - it seems to me that it's more effective at preventing a bug from turning into a vuln. Anytime your fuzzer gets an out-of-range result, you're safest assuming it can be used against you; not sure aslr would change that since there are plenty of ways of getting around it ...
2
You should run a Windows box with a Linux VM or vice-versa
Not to mention a lot of PoC code depends more on the language than the OS (not 100% of the time obviously)
But other than that it really depends on what particularly you were trying to perform or test against, but I've always been a fan of Linux with the Windows VM on a laptop since I've had more ...
2
The primary source of vulnerabilities are accidents rather than intentional.
When the browser crashes, security experts debug how that happened with a debugger, and see if they can reproduce the crash. Thus, it comes from noticing vulns as they happen, rather than looking for vulns.
When programming, such as building a website, when using some obscure ...
2
When writting my response to you, I remembered what might be the problem and I've tested it and bingo - that's exactly what's wrong.
The problem isn't with a script, but with a generic_send_tcp - this is not acting as it should. If I use the following command line:
line_send_tcp 10.1.1.169 21 ftp.spk 0
instead of
generic_send_tcp 10.1.1.169 21 ftp.spk 0
...
2
Try replacing
s_string('fuzz')
with
s_string('fuzz', encoding='utf_8')
I think you can replace utf_8 with any other encoding that Python knows about.
Or, try defining a group with s_group() and specifying an explicit list of values you want it to try using.
2
No fuzzing tool will scan a windows binary looking for vulnerabilities, because that is not fuzzing! There are dynamic or static analysis tools that can look at the code or a compiled binary to determine if it is vulnerable. From experience all of these analysis tools produce tons of false posties and false negatives.
Using a fuzzing framework like ...
2
This is one of the best ways to do it, but be careful of error-based injection issues. You might find that every single result displays the random token in the output because each column is bound to an integer result, and a string will cause a cast error. In such a case, the only way to detect it is to look for typical SQL server / MySQL / PostgreSQL error ...
2
If you like to automate fingerprinting i recommend using more than just one indicator, because sometimes it happens to be a little tricky...
Even i hate those timing attacks they are sometimes quite useful... Here another hint on different sql dialects...
(MSSQL) http://www.example.com/abc.php?id=1; waitfor delay '0:0:10'--
(MySQL) ...
2
You can fuzz GUI using Peach Fuzzing Framework (http://peachfuzzer.com)
Here is an article about it: http://phed.org/2008/01/13/peach-21-fuzzing-gui-applications/
1
Sorry I cant help directly with the SPIKE component but how do you know that the FreeFloat FTP server is even insecure and will crash? It may be well written and able to handle everything that SPIKE throws at it.
In the mean time, metasploit has great FTP fuzzing modules that I have used in the past with lots of success.
...
Only top voted, non community-wiki answers of a minimum length are eligible
