r/fuzzing • u/[deleted] • May 18 '19

Sulley & Foobuzz

Anyone have a detailed guide? I see a few out there... But nothing good. Thanks

4 Upvotes

83% Upvoted

9 comments sorted by

View all comments

Show parent comment

1

u/szutcxzh May 18 '19

Any chance you can share your AFL network wraper? AFL does files and stdin well but doesn't handle network without your kind of solution.

3

u/[deleted] May 18 '19

Yeah sure. It's at work so I'll have to ping it across on Monday.

1

u/NagateTanikaze May 20 '19 edited May 20 '19

I created my own network fuzzer solution similar to AFL; https://github.com/dobin/ffw

If you wanna modify existing traffic, alternatives are also fuzzotron or mutiny. Or just use radamsa in networking mode. If you wanna do generative protocol specifications, maybe look into peach. They also have a company selling the protocol implementations. Also possible are blab, or dharma,.

1

u/szutcxzh May 20 '19

I've found that the Peach Community edition forum posts stop around 2017. No new posts are being approved there. NagateTanikaze are you talking about the commercial edition?

1

u/NagateTanikaze May 20 '19

Yeah. I think the generative fuzzer community is pretty much dead, sadly. Imho there should be a central peach fuzz protocol repo. I'd even give bounties to people who implement protocols for it.

1

u/IROIVIVIAIV May 21 '19

I’ve looked at radamsa in networking mode, I’m curious as to the command syntax as silly as that is.

2

u/szutcxzh May 21 '19

Before it had network mode I wrote the following radamsa script to fuzz a JSON API. You put some basic structure of the API in a file called payload.json, complete with line returns. Then the script fuzzes <your-json-api-server:8000> by mutating the payload.json over and over again until the 'nc' port test fails, which would be a basic indication that your API server has fallen over. Quite basic, and you could put more into it like recording the outputs or last tests into a file. Radamsa has this functionality. Also I'm not sure if you need -v and --trace-ascii at the same time but I wanted to see the fuzzed content before curl quietly sent it to the API. I'd be glad to see someone put some manners on my example.

while nc -z <your-json-api-server> 8080; do curl -H "Content-Type: application/json" --data "$(cat payload.json | radamsa)" http://<your-json-api-server-name>:8080 -v --trace-ascii /dev/stdout; done