nccgroup/fuzzowskile fuzzer de protocole réseau que nous voudrons utiliser.
█ █
████████
██████████
██ ████ ██
██ ████ ██
████ ████
█ ████████████ █
█ ██████████ █ Fuzzowski Network Fuzzer
█ █ █ █ 🄯 Fuzzers, inc.
██ ██ by Mario Rivas
L'idée est d'être le Fuzzer de protocole réseau que nous voulons utiliser.
Le but de cet outil est d'assister tout au long du processus de fuzzing d'un protocole réseau, permettant de définir les communications, aidant à identifier les "suspects" de plantage d'un service, et bien plus encore.
[16/12/2019]
virtualenv venv -p python3
source venv/bin/activate
pip install -r requirements.txt
usage: python -m fuzzowski [-h] [-p {tcp,udp,ssl}] [-b BIND] [-st SEND_TIMEOUT]
[-rt RECV_TIMEOUT] [--sleep-time SLEEP_TIME] [-nc] [-tn]
[-nr] [-nrf] [-cr]
[--threshold-request CRASH_THRESHOLD_REQUEST]
[--threshold-element CRASH_THRESHOLD_ELEMENT]
[--ignore-aborted] [--ignore-reset] [--error-fuzz-issues]
[-c CALLBACK | --file FILENAME] -f
{cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}
[-r FUZZ_REQUESTS [FUZZ_REQUESTS ...]]
[--restart module_name [args ...]]
[--restart-sleep RESTART_SLEEP_TIME]
[--monitors {IPPMon} [{IPPMon} ...]] [--path PATH]
[--document_url DOCUMENT_URL]
host port
█ █
████████
██████████
██ ████ ██
██ ████ ██
████ ████
█ ████████████ █
█ ██████████ █ Fuzzowski Network Fuzzer
█ █ █ █ 🄯 Fuzzers, inc.
██ ██
positional arguments:
host Destination Host
port Destination Port
optional arguments:
-h, --help show this help message and exit
Connection Options:
-p {tcp,udp,ssl}, --protocol {tcp,udp,ssl}
Protocol (Default tcp)
-b BIND, --bind BIND Bind to port
-st SEND_TIMEOUT, --send_timeout SEND_TIMEOUT
Set send() timeout (Default 5s)
-rt RECV_TIMEOUT, --recv_timeout RECV_TIMEOUT
Set recv() timeout (Default 5s)
--sleep-time SLEEP_TIME
Sleep time between each test (Default 0)
-nc, --new-conns Open a new connection after each packet of the same test
-tn, --transmit-next-node
Transmit the next node in the graph of the fuzzed node
RECV() Options:
-nr, --no-recv Do not recv() in the socket after each send
-nrf, --no-recv-fuzz Do not recv() in the socket after sending a fuzzed request
-cr, --check-recv Check that data has been received in recv()
Crashes Options:
--threshold-request CRASH_THRESHOLD_REQUEST
Set the number of allowed crashes in a Request before skipping it (Default 9999)
--threshold-element CRASH_THRESHOLD_ELEMENT
Set the number of allowed crashes in a Primitive before skipping it (Default 3)
--ignore-aborted Ignore ECONNABORTED errors
--ignore-reset Ignore ECONNRESET errors
--error-fuzz-issues Log as error when there is any connection issue in the fuzzed node
Fuzz Options:
-c CALLBACK, --callback CALLBACK
Set a callback address to fuzz with callback generator instead of normal mutations
--file FILENAME Use contents of a file for fuzz mutations
Fuzzers:
-f {cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}, --fuzz {cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}
Available Protocols
-r FUZZ_REQUESTS [FUZZ_REQUESTS ...], --requests FUZZ_REQUESTS [FUZZ_REQUESTS ...]
Requests of the protocol to fuzz, default All
dhcp: [opt82]
ipp: [http_headers, get_printer_attribs, print_uri_message, send_uri, get_jobs, get_job_attribs]
lpd: [long_queue, short_queue, ctrl_file, data_file, remove_job]
telnet_cli: [commands]
tftp: [read]
raw: ['\x01string\n' '\x02request2\x00' ...]
Restart options:
--restart module_name [args ...]
Restarter Modules:
run: '<executable> [<argument> ...]' (Pass command and arguments within quotes, as only one argument)
smartplug: It will turn off and on the Smart Plug
teckin: <PLUG_IP>
--restart-sleep RESTART_SLEEP_TIME
Set sleep seconds after a crash before continue (Default 5)
Monitor options:
--monitors {IPPMon} [{IPPMon} ...], -m {IPPMon} [{IPPMon} ...]
Monitor Modules:
IPPMon: Sends a get-attributes IPP message to the target
Other Options:
--path PATH Set path when fuzzing HTTP based protocols (Default /)
--document_url DOCUMENT_URL
Set Document URL for print_uri
Fuzzer l'opération IPP get_printer_attribs avec les options par défaut :
python -m fuzzowski printer1 631 -f ipp -r get_printer_attribs --restart smartplug
Utiliser la fonctionnalité raw de IPP pour fuzzer le protocole finger :
python -m fuzzowski printer 79 -f raw -r '{{root}}\n'
Utiliser la fonctionnalité raw de IPP pour fuzzer le protocole finger, mais au lieu d'utiliser les mutations prédéfinies, utiliser un fichier :
python -m fuzzowski printer 79 -f raw -r '{{root}}\n' --file 'path/to/my/fuzzlist'
Exemple de Fuzzer avec état, démontrant l'utilisation de s_response et s_variable pour obtenir un jeton nécessaire pour fuzzer une requête. Cet exemple est basé sur le cas de test du serveur http mock
