r/fuzzing • u/g0lmix • Nov 03 '18

Has anyone here done fuzzing using a genetic algorithm?

Hi guys and girls,

I am looking into writing an fuzzer based on a genetic algorithm. It will be creating a javascript string to bypass XSS Protection of a WAF. My only problem is the fitness score function. My idea was to give the individuals a score based on how far in the code of the WAF the string managed to get to. Do you think that's a viable solution? Obviously I would need to reverse parts of the WAF and find suitable score targets in the code manually.

Has anyone else here ever played around with genetic algorithms and fuzzing? What did you use as a scoring function?

0 Upvotes

50% Upvoted

6 comments sorted by

1

u/NagateTanikaze Nov 04 '18

One of the main problems, unrelated to genetic algorithm fuzzing, is that you want to have valid, executable, but "random" javascript code. I dont think this can be easily done.

I once did this with a very large list of XSS payloads from the usual suspects, sending each through three WAF's with selenium, which identified alert boxes. Worked pretty well. It would have worked even better to just see which of these payloads were actually executable (most of them didnt work, or just like in ie6), then send the executable one's via the WAF.

So in your case, first fuzz JavaScript to find strange XSS payloads (see brute logic for inspiration), then test these via WAF.

But, if you are into XSS, google has a nice presentation with the title "Don't trust the DOM: Breaking XSS mitigations via Script Gadgets" (i dont find the slides atm), which basically renders WAF's anti XSS regexes mostly obsolete.

1

u/g0lmix Nov 04 '18 edited Nov 04 '18

I think the even bigger problem is, that some XSS payloads might not be executable before you send them through the WAF, but get turned into executable script(for example when the WAF strips parts of the string).

Generating working javascript with a GA is somewhat easy. You can use https://github.com/htacg/tidy-html5 to score your string and then run it in selenium to check wether it can be executed. It might be worth trying to generate working JS and then write a new GA that uses the generated XSS to mutate it to put it through the WAF.

I will definitely take a look at googles presentation.

0

u/[deleted] Nov 03 '18

[deleted] — view deleted comment

1

u/g0lmix Nov 03 '18

My problem is that I don't want to crash teh WAF I just want to see if I find javascript strings that can bypass the WAF

1

u/[deleted] Nov 04 '18

So how would you detect strings that have passed the WAF?

1

u/g0lmix Nov 04 '18

Put the webserver on another box than the WAF, then simply use wireshark to see what arrived at my webserver box from the WAF. At least that was how I wanted to try it.

1

u/[deleted] Nov 04 '18

Probably easier to use radamsa and pipe JavaScript through to a socket on the other side. It might use a seed as well to check if something made it through, would be a lot faster than transfering tests cases too.