Metafuzz 0.3 Building Boring Fuzzers, Faster Ben Nagy
This is not... A Fuzzer. It’s a framework for building fuzzers. A Ruby port of Peach Fuzz. Emergent, Genetic, Artificially Intelligent, Protocol Autoanalytic, Code Coverage Adaptive or Next Generation 100% done  (but it’s good enough for government work)
What’s included in 0.3 Four main components: BinStruct Define protocol data units (PDUs), also works as a half decent parser. Designed for packed binary structures, support hacked in at the last second for token separated text. Generators Some generator classes to help you create output streams that range from simple to as complex as you like. Fuzzer An example auto-fuzzer. It’s pretty simple, but has hooks for extension. If you don’t like it, keep the BinStruct class and write your own (and send me a copy). FSA A tool for creating finite state automata to automate and track state transitions for stateful protocols.
Generators Generators::Repeater ( Element, Start, Step, Limit, *Transforms ) # Example – Kickin’ It Old Skool include Generators g=Repeater.new(‘A’,0,256,10000,proc {|a| a.to_s}) g.next => “AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...” # What’s with the  proc {|a| a.to_s}  ? # Proc object – a portable code block. In this # case,without it the output would be an Array at each  # step. The framework uses these kinds of things a lot. # Equivalent: g=Generators::Repeater.new(‘A’,0,256,10000) g.next.to_s
Generators – Repeater Generators::Repeater include Generators # Example - Dictionary b33r=%w(asahi chang singha tiger kloster) beerz=Repeater.new(b33r,1,1,1,proc {|a| a.to_s.capitalize}) beerz.next => “Asahi” # Example – Incrementor nums=Repeater.new((1..1000),1,1,1,proc {|a| a.first.succ * 8}) nums.next => 16 # Example – Mutator require ‘base64’ g=Repeater.new(beerz,1,1,1,proc {|a| Base64.encode64 a.to_s}) g.next => "QXNhaGk=\n"
Generators - Cartesian Generators::Cartesian # Example – Long Drinks base=%w(black rum vodka gin whisky) mix=%w(soda coke tonic lemonade beer) drink=Generators::Cartesian.new(base, base, mix) drink.next => [“black”, “black”, “soda”] # fuzzing bartenders while drink.next? order.base, order.extra, order.mixer = drink.next bartender.send order.to_s end # or orderstring=“Give me a %s, %s and %s.” % drink.next
Generators - Cartesian # Geek Moment – 3 line Ruby method for Cartesian Product def cartprod(base, *others)  return base.map{|a|[a]} if others.empty? others = cartprod(*others) base.inject([]) { | r, a |  others.inject(r) { | r, b |  r << ([a, *b])  }  } end # (I didn’t write that, it was a guy called Brian Schr öder)
Generators - Other Some more useful Generators... Generators::Chain(Generator, Generator, ...) Generators::Static(Element, Limit, *Transforms) md5salt=proc {|s|  OpenSSL::Digest::MD5.new( s + rand(256).chr )  }  g=Generators::Static.new(“beer&quot;, 5, md5salt) g.next => e2fc714c4727ee9395f324cd2e7f331f g.next => dcc4a4d1992c0cd595454eb34b74e761 Generators::BinaryCornerCases( Integer ) BinaryCornerCases.new(16).to_a.map {|c| “%.16b” % c} [&quot;1111111111111111&quot;, &quot;0000000000000000&quot;, &quot;1000000000000000&quot;, &quot;0000000000000001&quot;,  &quot;0111111111111111&quot;, &quot;1111111111111110&quot;, &quot;1100000000000000&quot;, &quot;0000000000000011&quot;,  &quot;0011111111111111&quot;, &quot;1111111111111100&quot;, &quot;1110000000000000&quot;, &quot;0000000000000111&quot;,  &quot;0001111111111111&quot;, &quot;1111111111111000&quot;, &quot;1010101010101010&quot;, &quot;0101010101010101&quot;]
“ Meta” What’s all this “meta” stuff? Metadata – data about data.   The BinStruct field objects include metadata that lets us take a lot of the logic out of the output generator (fuzzer) so it can be made more generic Metaprogramming – code that writes code. When you inherit from the BinStruct class you can define your structure using a very abbreviated syntax
BinStruct - Definition class BeerReq < BinStruct bitstring  :flags, 8, &quot;Beer Flags&quot; signed  :temp,  8, &quot;Beer Temperature&quot; unsigned  :len,  8, &quot;Name Length&quot; string :name,  'self.len * 8', &quot;Beer Name&quot; string  :extra, 32*8, &quot;Extra Beer Data&quot;,  'self.flags[0..0]==&quot;1&quot;' end
BinStruct - Parsing class BeerReq < BinStruct bitstring :flags, 8, &quot;Beer Flags&quot; signed :temp, 8, &quot;Beer Temperature&quot; unsigned :len, 8, &quot;Name Length&quot; string :name, 'self.len * 8', &quot;Beer Name&quot; string :extra, 32*8, &quot;Extra Beer Data&quot;, 'self.flags[0..0]==&quot;1&quot;' end data=&quot;\200\377\005ASAHISuper Dry Beer From Japan but this is too long&quot; BeerReq.new(data).inspect  # data is shortened Output: Beer Flags: 10000000 Beer Temperature: -1 Name Length: 5 Beer Name: ASAHI Extra Beer Data: Super Dry Beer From Japan but th
BinStruct – Template PDUs class HTTPGet < BinStruct string :op, 0, &quot;Operation&quot; string :dir, 0, &quot;Directory&quot; string :ver, 0, &quot;Version&quot; separator ' ' default_value :op, &quot;GET&quot; default_value :dir, '/' default_value :ver, &quot;HTTP/1.0\n\n&quot; end req=HTTPGet.new req.to_s ; req.op; req[:op] “ GET / HTTP/1.0\n\n” “ GET” #<Fields::StringField:0x2754160 @desc=...>
BinStruct – Other Stuff Can create nested structures with add_child method, allows children to reference their parent object with self.parent Can easily create new field classes with their own wrappers for packing / unpacking data Can define new instance methods that only apply to objects of the new subclass. In other words, it’s not a config file, it’s normal Ruby code. Can manually access and modify the internal array of Field objects, set the raw binary contents of fields to bypass sign checks etc. Feel free to shoot self.foot
Fuzzing time! class BeerReq < BinStruct bitstring :flags, 8, &quot;Beer Flags&quot; signed :temp, 8, &quot;Beer Temperature&quot; unsigned :len, 8, &quot;Name Length&quot; string :name, 'self.len * 8', &quot;Beer Name&quot; string :extra, 32*8, &quot;Extra Beer Data&quot;, 'self.flags[0..0]==&quot;1&quot;' end require ‘fuzzer’ beerfuzz=Fuzzer.new(BeerReq.new) beerfuzz.basic_tests {|req| p req.to_s} What will it do? Enumerate numeric fields 8 bits or less, run corner cases on longer ones. Expand strings. Delete each field Insert overflow junk before each field, adapting to the field type For text protocols, extend separators
Fuzzing - Fixups require ‘fuzzer’ fixlen=proc {|req| req.len=req.name.length} beerfuzz=Fuzzer.new(BeerReq.new, fixlen) beerfuzz.basic_tests {|req| p req.to_s} What will it do? Fixups will be run, in order, on each new object before it is yielded to the block. By default, the object will also be yielded unfixed, but you can tell it not to. You can specify as many fixups as you want – eg to fix a length and then calculate a checksum afterwards
Fuzzing – Custom Fuzzing Code module Fields class EmailField < StringField # no special behaviour end end module Mutations # define a proc that creates a generator Replacement_Generators[“email”]=proc {... end class Foo < BinStruct email :eml, [...] end fuzz=Fuzzer.new(Foo) # All done.
Fuzzing – Custom Fuzzing Code Don’t forget:  Some protocols just need custom lovin’
Finite State Automata
FSA – Building - Nodes require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer end Once the nodes are defined, we need to connect them with edges.
FSA – Building - Edges require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer edge :init, :ordered, :send, proc {...} edge :ordered, :accepted, :recv, proc, proc ... Send edges have one block, which is an action block. Action blocks need to create or process the PDU, update state etc Receive edges have a match block and an action block. Match blocks inspect data and say “is this data for me?”
FSA – Building - Blocks require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer order=proc { set_state( :ordered_beer, “Asahi” ) BeerReq.new( &quot;\000\003\005Asahi” ) } beer_match=proc {|beer| beer.name == get_state :ordered_beer }
FSA - Using beer=BeerOrder.new puts “At Node #{beer.current_node.name}&quot; beer.navigate(beer.init, beer.ordered) if beer.current_node.can_process? response beer.deliver response end beer.state.inspect; beer.state[:ordered_beer] beer.reset You get the idea.
Not Done Yet Delivery – modular send and receive machinery that can be hooked up to the FSA for standard stuff like TCP, UDP, RAW etc Automation – with an FSA and a set of BinStructs, traverse every node and fuzz every sendable packet. Not that hard, I just need to get around to remembering Djikstra’s Algorithm. Linked Fields – allow user to link fields like Length, Value pairs so Fuzzer can test combinations. Probably lots of other stuff I didn’t think of.
Questions? Feedback / Beer: bnagy@eeye.com

More Related Content

PDF
Yapc::NA::2009 - Command Line Perl
PDF
C: A Humbling Language
PDF
Php engine
PPTX
Rubish- A Quixotic Shell
PDF
festival ICT 2013: Solid as diamond: use ruby in an web application penetrati...
PDF
Perl 5.10
PDF
Linux shell
PDF
Ruby 1.9
Yapc::NA::2009 - Command Line Perl
C: A Humbling Language
Php engine
Rubish- A Quixotic Shell
festival ICT 2013: Solid as diamond: use ruby in an web application penetrati...
Perl 5.10
Linux shell
Ruby 1.9

What's hot (20)

PDF
Quick tour of PHP from inside
PDF
Php and threads ZTS
PDF
Memory Manglement in Raku
PDF
PHP Internals and Virtual Machine
ODP
Perl - laziness, impatience, hubris, and one liners
ODP
Php opcodes sep2008
DOC
Source Code of Building Linux IPv6 DNS Server (Complete Sourcecode)
PPT
Argon walkthru 1-26
ODP
PHP5.5 is Here
PDF
Hypers and Gathers and Takes! Oh my!
PPT
Working with databases in Perl
PDF
PDF
PHP 7 OPCache extension review
PDF
SymfonyCon 2017 php7 performances
PDF
Computer Security
PPT
A Life of breakpoint
PDF
Preon (J-Fall 2008)
ZIP
Ruby on Rails: Tasty Burgers
PDF
node ffi
PDF
Shell scripting
Quick tour of PHP from inside
Php and threads ZTS
Memory Manglement in Raku
PHP Internals and Virtual Machine
Perl - laziness, impatience, hubris, and one liners
Php opcodes sep2008
Source Code of Building Linux IPv6 DNS Server (Complete Sourcecode)
Argon walkthru 1-26
PHP5.5 is Here
Hypers and Gathers and Takes! Oh my!
Working with databases in Perl
PHP 7 OPCache extension review
SymfonyCon 2017 php7 performances
Computer Security
A Life of breakpoint
Preon (J-Fall 2008)
Ruby on Rails: Tasty Burgers
node ffi
Shell scripting
Ad

Viewers also liked (20)

PDF
EMS Physio catalogue 2016 2017
PPT
Level 1 Slides Lessons 1 5 V4wb70 Ml
PDF
DSD-INT 2015- Open source pre and postprocessing workshop- Bert Jagers
PDF
Quality into manufacturing & services
PDF
Guia feria de tabaco 2011
DOCX
Christopher Anderson SPHR CBS VP HR Hiring Trends
PPTX
Negocios en Red
PDF
Pdf_presentasion
PPT
PPTX
E-Business Suite Release 12 Payables Upgrade: Like for Like and Then Some
PDF
CASE Network Report 88 - Deep Integration with the EU and its Likely Impact o...
PPS
El Famoso Desayuno De Villa O Higgins
PPT
Case Study - Energizer UK
DOCX
Funbiketour
PDF
Seabee Courier Jan. 4, 2013
DOCX
Seguridad en mainframe
PPS
Aurten Bai Athletic Txapeldun¡¡¡
PDF
Constructorpoznan
PPT
EMS Physio catalogue 2016 2017
Level 1 Slides Lessons 1 5 V4wb70 Ml
DSD-INT 2015- Open source pre and postprocessing workshop- Bert Jagers
Quality into manufacturing & services
Guia feria de tabaco 2011
Christopher Anderson SPHR CBS VP HR Hiring Trends
Negocios en Red
Pdf_presentasion
E-Business Suite Release 12 Payables Upgrade: Like for Like and Then Some
CASE Network Report 88 - Deep Integration with the EU and its Likely Impact o...
El Famoso Desayuno De Villa O Higgins
Case Study - Energizer UK
Funbiketour
Seabee Courier Jan. 4, 2013
Seguridad en mainframe
Aurten Bai Athletic Txapeldun¡¡¡
Constructorpoznan
Ad

Similar to Metafuzz: Building Boring Fuzzers Faster, Using Metadata (20)

PPT
Working with Bytecode
PDF
Apidays Paris 2023 - Forget TypeScript, Choose Rust to build Robust, Fast and...
PDF
PostgreSQL as seen by Rubyists (Kaigi on Rails 2022)
PDF
PVS-Studio delved into the FreeBSD kernel
PDF
SDPHP - Percona Toolkit (It's Basically Magic)
PPT
Shibboleth 2.0 SP slides - Installfest
PDF
Modern C++
PDF
How to use Parquet as a basis for ETL and analytics
PPTX
Tugas pw [kelompok 25]
PPTX
Presentasi Kelompok 25 PW A+B
PDF
Accumulo Summit 2014: Accismus -- Percolating with Accumulo
PPTX
Apache Beam in Production
PPTX
06-PHPIntroductionserversicebasicss.pptx
DOCX
Assignment 13assg-13.cppAssignment 13assg-13.cpp   @auth.docx
PPTX
Performance .NET Core - M. Terech, P. Janowski
PDF
Introduction to Arduino and Circuits
PDF
Waiting for the Linux-version: Checking the Code of Inkscape Graphics Editor
PPT
What's New in ZF 1.10
PDF
Tour of Ecto March 2017 Dave Lucia
PPT
Python Objects
Working with Bytecode
Apidays Paris 2023 - Forget TypeScript, Choose Rust to build Robust, Fast and...
PostgreSQL as seen by Rubyists (Kaigi on Rails 2022)
PVS-Studio delved into the FreeBSD kernel
SDPHP - Percona Toolkit (It's Basically Magic)
Shibboleth 2.0 SP slides - Installfest
Modern C++
How to use Parquet as a basis for ETL and analytics
Tugas pw [kelompok 25]
Presentasi Kelompok 25 PW A+B
Accumulo Summit 2014: Accismus -- Percolating with Accumulo
Apache Beam in Production
06-PHPIntroductionserversicebasicss.pptx
Assignment 13assg-13.cppAssignment 13assg-13.cpp   @auth.docx
Performance .NET Core - M. Terech, P. Janowski
Introduction to Arduino and Circuits
Waiting for the Linux-version: Checking the Code of Inkscape Graphics Editor
What's New in ZF 1.10
Tour of Ecto March 2017 Dave Lucia
Python Objects

More from amiable_indian (20)

PDF
Phishing As Tragedy of the Commons
PDF
Cisco IOS Attack & Defense - The State of the Art
PDF
Secrets of Top Pentesters
PPS
Workshop on Wireless Security
PDF
Insecure Implementation of Security Best Practices: of hashing, CAPTCHA's and...
PPS
Workshop on BackTrack live CD
PPS
Reverse Engineering for exploit writers
PPS
State of Cyber Law in India
PPS
AntiSpam - Understanding the good, the bad and the ugly
PPS
Reverse Engineering v/s Secure Coding
PPS
Network Vulnerability Assessments: Lessons Learned
PPS
Economic offenses through Credit Card Frauds Dissected
PPS
Immune IT: Moving from Security to Immunity
PPS
Reverse Engineering for exploit writers
PPS
Hacking Client Side Insecurities
PDF
Web Exploit Finder Presentation
PPT
Network Security Data Visualization
PPT
Enhancing Computer Security via End-to-End Communication Visualization
PDF
Top Network Vulnerabilities Over Time
PDF
What are the Business Security Metrics?
Phishing As Tragedy of the Commons
Cisco IOS Attack & Defense - The State of the Art
Secrets of Top Pentesters
Workshop on Wireless Security
Insecure Implementation of Security Best Practices: of hashing, CAPTCHA's and...
Workshop on BackTrack live CD
Reverse Engineering for exploit writers
State of Cyber Law in India
AntiSpam - Understanding the good, the bad and the ugly
Reverse Engineering v/s Secure Coding
Network Vulnerability Assessments: Lessons Learned
Economic offenses through Credit Card Frauds Dissected
Immune IT: Moving from Security to Immunity
Reverse Engineering for exploit writers
Hacking Client Side Insecurities
Web Exploit Finder Presentation
Network Security Data Visualization
Enhancing Computer Security via End-to-End Communication Visualization
Top Network Vulnerabilities Over Time
What are the Business Security Metrics?

Recently uploaded (20)

PDF
A contest of sentiment analysis: k-nearest neighbor versus neural network
PDF
From MVP to Full-Scale Product A Startup’s Software Journey.pdf
PDF
Convolutional neural network based encoder-decoder for efficient real-time ob...
PDF
UiPath Agentic Automation session 1: RPA to Agents
PDF
A review of recent deep learning applications in wood surface defect identifi...
PDF
Five Habits of High-Impact Board Members
PDF
1 - Historical Antecedents, Social Consideration.pdf
PDF
sustainability-14-14877-v2.pddhzftheheeeee
PDF
Enhancing emotion recognition model for a student engagement use case through...
PPT
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
PPTX
2018-HIPAA-Renewal-Training for executives
PDF
Architecture types and enterprise applications.pdf
PPTX
The various Industrial Revolutions .pptx
PDF
Taming the Chaos: How to Turn Unstructured Data into Decisions
PPT
What is a Computer? Input Devices /output devices
PDF
CloudStack 4.21: First Look Webinar slides
PPT
Module 1.ppt Iot fundamentals and Architecture
PDF
Zenith AI: Advanced Artificial Intelligence
PPTX
Modernising the Digital Integration Hub
PPTX
Chapter 5: Probability Theory and Statistics
A contest of sentiment analysis: k-nearest neighbor versus neural network
From MVP to Full-Scale Product A Startup’s Software Journey.pdf
Convolutional neural network based encoder-decoder for efficient real-time ob...
UiPath Agentic Automation session 1: RPA to Agents
A review of recent deep learning applications in wood surface defect identifi...
Five Habits of High-Impact Board Members
1 - Historical Antecedents, Social Consideration.pdf
sustainability-14-14877-v2.pddhzftheheeeee
Enhancing emotion recognition model for a student engagement use case through...
Galois Field Theory of Risk: A Perspective, Protocol, and Mathematical Backgr...
2018-HIPAA-Renewal-Training for executives
Architecture types and enterprise applications.pdf
The various Industrial Revolutions .pptx
Taming the Chaos: How to Turn Unstructured Data into Decisions
What is a Computer? Input Devices /output devices
CloudStack 4.21: First Look Webinar slides
Module 1.ppt Iot fundamentals and Architecture
Zenith AI: Advanced Artificial Intelligence
Modernising the Digital Integration Hub
Chapter 5: Probability Theory and Statistics

Metafuzz: Building Boring Fuzzers Faster, Using Metadata

  • 1. Metafuzz 0.3 Building Boring Fuzzers, Faster Ben Nagy
  • 2. This is not... A Fuzzer. It’s a framework for building fuzzers. A Ruby port of Peach Fuzz. Emergent, Genetic, Artificially Intelligent, Protocol Autoanalytic, Code Coverage Adaptive or Next Generation 100% done (but it’s good enough for government work)
  • 3. What’s included in 0.3 Four main components: BinStruct Define protocol data units (PDUs), also works as a half decent parser. Designed for packed binary structures, support hacked in at the last second for token separated text. Generators Some generator classes to help you create output streams that range from simple to as complex as you like. Fuzzer An example auto-fuzzer. It’s pretty simple, but has hooks for extension. If you don’t like it, keep the BinStruct class and write your own (and send me a copy). FSA A tool for creating finite state automata to automate and track state transitions for stateful protocols.
  • 4. Generators Generators::Repeater ( Element, Start, Step, Limit, *Transforms ) # Example – Kickin’ It Old Skool include Generators g=Repeater.new(‘A’,0,256,10000,proc {|a| a.to_s}) g.next => “AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...” # What’s with the proc {|a| a.to_s} ? # Proc object – a portable code block. In this # case,without it the output would be an Array at each # step. The framework uses these kinds of things a lot. # Equivalent: g=Generators::Repeater.new(‘A’,0,256,10000) g.next.to_s
  • 5. Generators – Repeater Generators::Repeater include Generators # Example - Dictionary b33r=%w(asahi chang singha tiger kloster) beerz=Repeater.new(b33r,1,1,1,proc {|a| a.to_s.capitalize}) beerz.next => “Asahi” # Example – Incrementor nums=Repeater.new((1..1000),1,1,1,proc {|a| a.first.succ * 8}) nums.next => 16 # Example – Mutator require ‘base64’ g=Repeater.new(beerz,1,1,1,proc {|a| Base64.encode64 a.to_s}) g.next => &quot;QXNhaGk=\n&quot;
  • 6. Generators - Cartesian Generators::Cartesian # Example – Long Drinks base=%w(black rum vodka gin whisky) mix=%w(soda coke tonic lemonade beer) drink=Generators::Cartesian.new(base, base, mix) drink.next => [“black”, “black”, “soda”] # fuzzing bartenders while drink.next? order.base, order.extra, order.mixer = drink.next bartender.send order.to_s end # or orderstring=“Give me a %s, %s and %s.” % drink.next
  • 7. Generators - Cartesian # Geek Moment – 3 line Ruby method for Cartesian Product def cartprod(base, *others) return base.map{|a|[a]} if others.empty? others = cartprod(*others) base.inject([]) { | r, a | others.inject(r) { | r, b | r << ([a, *b]) } } end # (I didn’t write that, it was a guy called Brian Schr öder)
  • 8. Generators - Other Some more useful Generators... Generators::Chain(Generator, Generator, ...) Generators::Static(Element, Limit, *Transforms) md5salt=proc {|s| OpenSSL::Digest::MD5.new( s + rand(256).chr ) } g=Generators::Static.new(“beer&quot;, 5, md5salt) g.next => e2fc714c4727ee9395f324cd2e7f331f g.next => dcc4a4d1992c0cd595454eb34b74e761 Generators::BinaryCornerCases( Integer ) BinaryCornerCases.new(16).to_a.map {|c| “%.16b” % c} [&quot;1111111111111111&quot;, &quot;0000000000000000&quot;, &quot;1000000000000000&quot;, &quot;0000000000000001&quot;, &quot;0111111111111111&quot;, &quot;1111111111111110&quot;, &quot;1100000000000000&quot;, &quot;0000000000000011&quot;, &quot;0011111111111111&quot;, &quot;1111111111111100&quot;, &quot;1110000000000000&quot;, &quot;0000000000000111&quot;, &quot;0001111111111111&quot;, &quot;1111111111111000&quot;, &quot;1010101010101010&quot;, &quot;0101010101010101&quot;]
  • 9. “ Meta” What’s all this “meta” stuff? Metadata – data about data. The BinStruct field objects include metadata that lets us take a lot of the logic out of the output generator (fuzzer) so it can be made more generic Metaprogramming – code that writes code. When you inherit from the BinStruct class you can define your structure using a very abbreviated syntax
  • 10. BinStruct - Definition class BeerReq < BinStruct bitstring :flags, 8, &quot;Beer Flags&quot; signed :temp, 8, &quot;Beer Temperature&quot; unsigned :len, 8, &quot;Name Length&quot; string :name, 'self.len * 8', &quot;Beer Name&quot; string :extra, 32*8, &quot;Extra Beer Data&quot;, 'self.flags[0..0]==&quot;1&quot;' end
  • 11. BinStruct - Parsing class BeerReq < BinStruct bitstring :flags, 8, &quot;Beer Flags&quot; signed :temp, 8, &quot;Beer Temperature&quot; unsigned :len, 8, &quot;Name Length&quot; string :name, 'self.len * 8', &quot;Beer Name&quot; string :extra, 32*8, &quot;Extra Beer Data&quot;, 'self.flags[0..0]==&quot;1&quot;' end data=&quot;\200\377\005ASAHISuper Dry Beer From Japan but this is too long&quot; BeerReq.new(data).inspect # data is shortened Output: Beer Flags: 10000000 Beer Temperature: -1 Name Length: 5 Beer Name: ASAHI Extra Beer Data: Super Dry Beer From Japan but th
  • 12. BinStruct – Template PDUs class HTTPGet < BinStruct string :op, 0, &quot;Operation&quot; string :dir, 0, &quot;Directory&quot; string :ver, 0, &quot;Version&quot; separator ' ' default_value :op, &quot;GET&quot; default_value :dir, '/' default_value :ver, &quot;HTTP/1.0\n\n&quot; end req=HTTPGet.new req.to_s ; req.op; req[:op] “ GET / HTTP/1.0\n\n” “ GET” #<Fields::StringField:0x2754160 @desc=...>
  • 13. BinStruct – Other Stuff Can create nested structures with add_child method, allows children to reference their parent object with self.parent Can easily create new field classes with their own wrappers for packing / unpacking data Can define new instance methods that only apply to objects of the new subclass. In other words, it’s not a config file, it’s normal Ruby code. Can manually access and modify the internal array of Field objects, set the raw binary contents of fields to bypass sign checks etc. Feel free to shoot self.foot
  • 14. Fuzzing time! class BeerReq < BinStruct bitstring :flags, 8, &quot;Beer Flags&quot; signed :temp, 8, &quot;Beer Temperature&quot; unsigned :len, 8, &quot;Name Length&quot; string :name, 'self.len * 8', &quot;Beer Name&quot; string :extra, 32*8, &quot;Extra Beer Data&quot;, 'self.flags[0..0]==&quot;1&quot;' end require ‘fuzzer’ beerfuzz=Fuzzer.new(BeerReq.new) beerfuzz.basic_tests {|req| p req.to_s} What will it do? Enumerate numeric fields 8 bits or less, run corner cases on longer ones. Expand strings. Delete each field Insert overflow junk before each field, adapting to the field type For text protocols, extend separators
  • 15. Fuzzing - Fixups require ‘fuzzer’ fixlen=proc {|req| req.len=req.name.length} beerfuzz=Fuzzer.new(BeerReq.new, fixlen) beerfuzz.basic_tests {|req| p req.to_s} What will it do? Fixups will be run, in order, on each new object before it is yielded to the block. By default, the object will also be yielded unfixed, but you can tell it not to. You can specify as many fixups as you want – eg to fix a length and then calculate a checksum afterwards
  • 16. Fuzzing – Custom Fuzzing Code module Fields class EmailField < StringField # no special behaviour end end module Mutations # define a proc that creates a generator Replacement_Generators[“email”]=proc {... end class Foo < BinStruct email :eml, [...] end fuzz=Fuzzer.new(Foo) # All done.
  • 17. Fuzzing – Custom Fuzzing Code Don’t forget: Some protocols just need custom lovin’
  • 19. FSA – Building - Nodes require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer end Once the nodes are defined, we need to connect them with edges.
  • 20. FSA – Building - Edges require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer edge :init, :ordered, :send, proc {...} edge :ordered, :accepted, :recv, proc, proc ... Send edges have one block, which is an action block. Action blocks need to create or process the PDU, update state etc Receive edges have a match block and an action block. Match blocks inspect data and say “is this data for me?”
  • 21. FSA – Building - Blocks require ‘fsa’ class BeerOrder < FSA node :init, root=true node :ordered node :accepted node :paid node :got_change node :got_beer order=proc { set_state( :ordered_beer, “Asahi” ) BeerReq.new( &quot;\000\003\005Asahi” ) } beer_match=proc {|beer| beer.name == get_state :ordered_beer }
  • 22. FSA - Using beer=BeerOrder.new puts “At Node #{beer.current_node.name}&quot; beer.navigate(beer.init, beer.ordered) if beer.current_node.can_process? response beer.deliver response end beer.state.inspect; beer.state[:ordered_beer] beer.reset You get the idea.
  • 23. Not Done Yet Delivery – modular send and receive machinery that can be hooked up to the FSA for standard stuff like TCP, UDP, RAW etc Automation – with an FSA and a set of BinStructs, traverse every node and fuzz every sendable packet. Not that hard, I just need to get around to remembering Djikstra’s Algorithm. Linked Fields – allow user to link fields like Length, Value pairs so Fuzzer can test combinations. Probably lots of other stuff I didn’t think of.
  • 24. Questions? Feedback / Beer: bnagy@eeye.com