- So first, we're gonna talk a little bit
about the different kinds of fuzzers that we have out there
that are available.
We've already talked about the different classes of fuzzers
with the generation, mutation, and evolutionary fuzzers.
Let's go into the fuzzers
that are available on the commercial market.
The first one we'll talk about is Codenomicon.
This was recently acquired by Synopsys.
It's a very well-known and used generation-based fuzzer.
It is really designed around fuzzing file formats
and network protocols.
It has a very extensive suite of network protocols.
Some of the downsides of it
are that the test suites are not extensible in any way.
You tell it what parts of the protocol you want to fuzz
and they're more or less canned.
You can boost up types of values
that it tries as a test case
but really, it's not too terribly extensible.
So if you have a new feature in a protocol,
you're really dependent on Codenomicon
to implement that for you.
And this is the fuzzer
that found the famous Heartbleed vulnerability in OpenSSL.
You can find more information about Codenomicon Defensics
by going to www.codenomicon.com.
The next commercial fuzzer I'll talk about
was recently renamed.
It is called Spirent CyberFlood.
This was formerly Mu Dynamics
which was an acquisition by Spirent,
and this is really a network protocol-oriented fuzzer.
It's also generation-based
and one of the things that really makes this nice
is you can put a system under a load
while you're testing.
So in other words, you can simulate traffic.
You can simulate sessions.
And so if that's something you think you would want to do
in your systems, give Spirent a shot.
You can find out more information about CyberFlood
by going to www.spirent.com/Products/CyberFlood.
And then finally, on the commercial fuzzer side,
there is the Peach Fuzzer.
This is actually both a community edition that's for free
and a commercial edition of the Peach Fuzzer.
This fuzzer has an extensive set of features,
it's very well supported,
and it has quite a following in the open-source community
for doing different kinds of fuzzing.
It has a very extensive library called Pits
that you could purchase for file formats and protocols.
It's fairly well known.
And like I said, if you don't want to pay for Peach Fuzzer,
if you just wanted to try it out,
you can try the community edition.
But to find out more information, it's www.peach.tech.
So let's talk a little more
about what Peach Fuzzer actually is,
and this is the community edition.
They have really two versions of Peach Fuzzer.
There's version two and version three.
They have mostly migrated all development
over to version three
and version three is written in C Sharp
on the .NET ecosystem.
It is multi-platform.
You could use either Windows, Mac OS 10, or Linux,
and the way you would do that is by using the Mono Project
which allows you to compile C Sharp code
on those different types of systems.
It's a generation-based fuzzer, again,
but it can also do some mutation-based fuzzing as well.
You aren't stuck with the modeling.
If you don't want to do that,
you can do mutation-based fuzzing.
It has very extensive modeling
of not only protocols and messages
but also the state of a protocol.
So in other words, you can simulate a state machine
saying that "If I go into this state,"
"then I will send this message."
"If I receive another message, I go into a different state,"
and so on.
And all of the protocol modeling
and all of the data modeling
is all done with an XML file,
and so that's very, very extensive.
And these data models that you would write in XML
are called Peach Pits.
Not only does it have the state modeling features
that you need for that,
but it also can do robust fault monitoring
and for collection of crashes, and in some cases,
it can even tell you which crashes are the most important.
And you can find out more information at the link below.
Another open-source software package is Sulley,
and there is a fork of Sulley called Boofuzz
which really take a block-based approach
to modeling network protocols.
It's really designed around protocols
that you would connect over, let's say, a TCP connection.
And it's also generation-based as well.
It's written in Python.
And the model, you start out with a request
and then you add primitive fields to those requests,
and you can organize those in the blocks
and nested blocks and so on.
And they also have it fixed up
for things like checksums and size,
and then if you have, let's say,
a field that is repeated so many times
and you have a field that tells
how many times that other field is being repeated,
that's a count field,
it'll also do those as well
and make those fix-ups
so that the parser will actually accept the input.
And you can find out more information
about Sulley and Boofuzz at the link below.
I'll also have this link in a GitHub repository
that we have set up for this class as well
with a whole list of links.
Another fuzzer which has some really interesting properties
is called Radamsa.
It's a mutation-based fuzzer.
It's written in a language called Scheme,
which is a dialect of Lisp.
And it has an extraordinary ability
to infer patterns from a text in a protocol,
and it can mutate that input.
It's just an excellent, excellent mutation-based fuzzer,
especially for text-based protocols.
And it even has some modes where you can say,
"This text is going to look like XML" for example,
and it will do some of the fuzz testing against XML
where you could test against the parser
or you can test against even a program
that interprets the data based on an XML model.
And it's just really, really good for those kinds of tests.
But it's only for really doing local testing
against, let's say, files or passing onto a process.
And so if you wanted to do something
against a network-based protocol,
you would probably wanna use a proxy like Socat
which allows you to open a session
and then take the output from Radamsa
and actually feed it into that connection.
You can find out more information about Radamsa
at this link.
Another mutational fuzzer is Zzuf.
This is an older fuzzer that's designed around fuzzing files
like images and video.
And what makes it interesting is it's all written in C
and it can intercept programs directly
by linking in with them.
You use LD-PRELOAD and you use Zzuf as a library,
and you would, at run time, link that with the program
and that will do some file-based fuzz testing.
Even though it's been around a little longer,
it has a good track record of finding bugs
and if you're doing that kinda fuzzing,
this is something you should give a try.
You can find out more information at this link.
Another package that is a plugin
to the OWASP Zed Attack Proxy,
there is a feature in the OWASP Zed Attack Proxy, or ZAP,
and this is a fuzzer
that allows you to fuzz web applications.
And you can fuzz against HTTP.
You can fuzz against WebSockets.
And if you wanted to target a particular field,
you could just highlight that field and fuzz that,
and plug a buncha different values that it already provides.
It is kind of a canned fuzzer
but it is something that is very useful
for fuzzing web-based applications,
especially where you have a web-based application
that calls other programs
where you could somehow trigger a vulnerability
or an overflow in those programs.
And now starting to get into the evolutionary fuzzers.
One of the really first popular fuzzers
for evolutionary fuzzing
was a fuzzer called American Fuzzy Lop,
which was named after a rabbit,
and it was written by Michal Zalewski.
It works by instrumenting a program at compile-time,
so you do need, in most cases, to have the source code
for maximum coverage.
And it supports programs that are written
in C, C-Plus-Plus, or Objective C,
and you could've either used gcc or clang as the compiler.
And then there is some experimental support.
If you don't have source code,
you can run the program in QEMU, which is a system emulator.
This will allow you to do black-box testing
against programs that you don't have source code for.
It has a wonderful track record.
It's found many bugs.
It's also inspired forks for other languages such as Python.
And you can find more information about AFL at this link.
And then another advanced evolutionary fuzzer
that has been developed by a gentleman at Google
is called HongFuzz,
and this fuzzer provides more compile-time guidance
but it also includes some hardware features
that are in Intel processors
for things like code coverage monitoring.
It has better support for remote network processes than AFL
and you could fuzz things like an HTTP or a DNS server.
And like AFL, it's also found many bugs
and some of them critical.
And then finally, this is a really good curated list
that comes from secfigo,
and it has a list of books and tutorials and tools.
This is called Awesome Fuzzing
and that's the link where you can find Awesome Fuzzing
and it is a wonderful resource to keep up to date
and to see what some of the newer fuzzers that are out there
and some of the new forks because there's always,
especially on the evolutionary fuzzer size,
there's always new tools coming out.