Tag Info

Hot answers tagged

28

What is the purpose of a fuzzer? A fuzzer tries to elicit an unexpected reaction from the target software by providing input that wasn't properly planned for. It does this by throwing "creatively constructed" data as input to software. Expecting a phone number? Ha! I'm going to give you 1,024 characters of 0x00! Random hex! Unicode! A zero-width field! ...


18

A fuzzer is a (semi-)automated tool that is used for finding vulnerabilities in software which may be exploitable by an attacker. The benefits include, but are not limited to: Accuracy - A fuzzer will perform checks that an unaided human might miss Precision - A fuzzer provides a kind of benchmark against which software can be tested Speed - A fuzzer may ...


12

The basic path for exploiting an overflow-related vulnerability is to find a crash (often by fuzzing), evaluate the crash and whether it presents an attack path, and then build something to exploit it. Sometimes where one looks can involve knowledge of the architecture, such as when Charlie Miller noted that iOS 4.3 has a section of memory which will run ...


9

To look at your assumptions: many attack groups have resources vastly bigger than that of companies in a typical company security is a cost centre, so they never have enough staff or money in the black hat world, finding security flaws is a revenue stream fuzzing is done by security engineers and black hats fuzzing is by its very nature fallible. So ...


7

It sounds like you are confusing your work environment with your target environment. Which OS should you work from? There are far more useful tools in Linux than in Windows. Use Linux (or even a penetration testing distro like Backtrack) as a work environment. If you say that you could roll your own security tools (and why would you when there is a ...


7

Responses from a network service should fall into one of a few well defined and broad categories. If you send random data to, for example, an HTTP service, you expect to get back a lot of HTTP 400 results and perhaps a few other HTTP 4XX results. If anything ELSE happens, such as a timeout or a different response, then that anomalous result is worth noting ...


7

Updated answer: If you are using Windows, try the CERT Failure Observation Engine (FOE). It is a fuzzing framework for Windows. It has the ability to do file-based fuzzing, to click on dialog boxes, and other stuff. Previous answer: I suggest you start with zzuf. It is the simplest, easiest to use command-line fuzzer for fuzzing standalone programs ...


7

The technology to tap an internet connection and copy all the data going over it without anyone detecting anything has existed for quite some time. There are network hardware taps, software taps, and data dumps of all types that could be happening completely undetected by those whose traffic is being sniffed. Observing the data doesn't change it in this ...


6

from what I understand, they just send tons of random data at different services and observe their reaction to it This is partly true, depending on what you mean by "random". Fuzzers can be used that way for the purpose of identifying memory leaks in a program, but they can also be useful in pen-testing (by making the program crash). If you can crash ...


6

I don't have numbers for you, or specific guidelines, but I think an important issue to point out, but was not sufficiently emphasized in those links, is Code Coverage. It makes little sense to run a huge number of fuzz iterations, if they are all similar - from a code path point of view. That is, "dumb fuzzing" may generate many different inputs ...


6

You have the pen-test laptop and the fuzzing server. Pen-test laptop is typically an HP dm1z with 8GB of RAM running Win7 with VMware Workstation 8.0.1 with BackTrack 5R1 and potentially other Linux/BSD VMs. You can even run Mac OS X Snow Leopard and Lion in separate VMs using iBoot/Multibeast/Unibeast. Use of 2 ALFA USB WiFi AWUS036Hs via HakShop would be ...


6

There's two ways to decrypt SSL traffic in-transit: The first is to have the private key of the server. If you have that, you can feed it to wireshark which will do the rest. There are a handful of dedicated tools for this as well. But it can't be done without the server's private key. The second is to MITM the connection. Fiddler will do this, as ...


6

Maybe fire up Wireshark and see if one of the more popular Wireshark protocol dissectors successfully identifies the traffic while you interrogate/probe the service (i.e. use the “decode as” feature to force Wireshark to decode the packets as a particular protocol). Current list of dissectors: http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/ If ...


6

You are correct: technically, fuzzing is usually regarded as sending invalid or random requests/data, it's implied that you know what you're testing in order to "break" the input. In some terminology (PDF) white-box fuzzing is the close to former (generated input) and black-box fuzzing (random input) is the latter. What you're attempting is better described ...


5

ASLR is a broad term that encompases many different protections and techniques. In general, basic forms of ASLR (eg stack randomisation) are used to make development of exploits harder or impossible - but do not prevent the triggering of the bug and a crash of an application. Fuzzing should work the same with aslr enabled or not.


5

There is work on the topic, at several levels. fuzzing of the internal tables - very easy, and doesn't really work fuzzing of internal codecs such as z-streams fuzzing of internal formats, e.g. fonts, JPGs, TIFFs etc. - I'm aware of some buggy implementations of CCITT "fax" monochrome picture that are still used by some fax-to-PDF machines, i.e. the ...


4

Since both of your questions relate to groups, we should look at how they're used first. The purpose is to bind block data to a set of static values -- sulley iterates through the list of values and generates block data for each one. The example in the docs uses HTTP, where the block data is a simple HTTP request and the group values are HTTP verbs ('GET', ...


4

I like using the peach fuzzing platform. This contains a testing harness which will record memorydumps from crashes and link them to the fuzz test case. When the process crashes, the testing harness will restart it and continue until testing is complete. As far as I know !exploitable is pretty unique. Valgrind is useful at determining flaws like ...


4

Here's the best heuristic I know of. Run the program under Valgrind memcheck, and then look at the warnings that Valgrind outputs. We can classify them into a couple of categories: Invalid write: Look at the address. If the address is small (say, between 0x0 to 0xFFF, say), then this is a NULL pointer dereference: probably not exploitable, low priority. ...


4

The short answer is: no. Here the long answer: The origin of fuzzing (or fuzz testing) is sending random data or slightly random data (i.e. sticking to a certain format or mutating something valid). The goal of fuzzing is usually to provoke an application crash. This crash can then be analyzed with debuggers or memory monitoring tools (i.e. Valgrind) to ...


3

I once built one of these rigs for Electronic Arts to handle online-game traffic simulations to ensure the best possible user experience despite network conditions. The free option was NIST Net from the National Institute of Standards and Technology (NIST). Based on Linux, free, complex and limited, but might be just what your looking for. The expensive, ...


3

CERT's open source Linux Triage Tools can be used for triage of bugs found via fuzzing. The tools include a GDB extension that is similar to MSEC's !exploitable, but for Linux. http://www.cert.org/blogs/certcc/2012/04/cert_triage_tools_10.html


3

What an interesting question. I gather it's unix only, but if it's not, the first thing I'd recommend is testing it in both environments. Windows has a really good set of tools for doing heap debugging, dangerous api management, and so on - google App Verifier if you're interested. But in general, I'd say you should at the least try a release build, with ...


3

No one suggested a definitive answer, so I ran a tiny experiment. Based up on this experiment, here is my recommendation so far: Recommendation. When fuzzing, you might consider setting the environment variables LIBC_FATAL_STDERR_=1 MALLOC_CHECK_=3. This setting had no measurable performance impact in my experiment, and based upon my results, this setting ...


3

You can fuzz GUI using Peach Fuzzing Framework (http://peachfuzzer.com) Here is an article about it: http://phed.org/2008/01/13/peach-21-fuzzing-gui-applications/


2

If an application is going to crash from a test, a compiler option isn't going to save it. If your compile the application with gcc -D_FORTIFY_SOURCE=2 -O2 then the process will killed off more often due to minor memory infractions that wouldn't normally crash the process. A good example of this is that you will have an increased ability to detect ...


2

Off the top of my head, I don't think aslr will matter much one way or the other - it seems to me that it's more effective at preventing a bug from turning into a vuln. Anytime your fuzzer gets an out-of-range result, you're safest assuming it can be used against you; not sure aslr would change that since there are plenty of ways of getting around it ...


2

You should run a Windows box with a Linux VM or vice-versa Not to mention a lot of PoC code depends more on the language than the OS (not 100% of the time obviously) But other than that it really depends on what particularly you were trying to perform or test against, but I've always been a fan of Linux with the Windows VM on a laptop since I've had more ...


2

Try replacing s_string('fuzz') with s_string('fuzz', encoding='utf_8') I think you can replace utf_8 with any other encoding that Python knows about. Or, try defining a group with s_group() and specifying an explicit list of values you want it to try using.


2

When writting my response to you, I remembered what might be the problem and I've tested it and bingo - that's exactly what's wrong. The problem isn't with a script, but with a generic_send_tcp - this is not acting as it should. If I use the following command line: line_send_tcp 10.1.1.169 21 ftp.spk 0 instead of generic_send_tcp 10.1.1.169 21 ftp.spk 0 ...



Only top voted, non community-wiki answers of a minimum length are eligible