fuzzer

Documentation

Index

• type Config
• type CorpusEntry
• type CoverageGuidedFuzzer
  • func New(cfg Config) *CoverageGuidedFuzzer
  • func (f *CoverageGuidedFuzzer) Fuzz(maxExecs int64, maxTime time.Duration) []CorpusEntry
  • func (f *CoverageGuidedFuzzer) GetStats() FuzzStats
  • func (f *CoverageGuidedFuzzer) LoadCorpus(path string) error
  • func (f *CoverageGuidedFuzzer) SaveCorpus(path string) error
  • func (f *CoverageGuidedFuzzer) TestConnection() ResponseInfo
• type FuzzStats
• type ResponseInfo

Types

type Config

type Config struct {
	Target      string
	Method      string
	Body        string
	Headers     []string
	Cookies     string
	Proxy       string
	Timeout     int
	Points      []input.InjectionPoint
	Concurrency int
	MaxExecs    int64         // 0 = unlimited
	MaxTime     time.Duration // 0 = unlimited
	MaxDepth    int           // max mutation chain depth
}

Config for the coverage-guided fuzzer

type CorpusEntry

type CorpusEntry struct {
	Value       string
	Point       input.InjectionPoint
	Fingerprint string
	Response    ResponseInfo
	Energy      int // how many more mutations to generate from this
	Depth       int // mutation depth from seed
	Parent      int // index of parent in corpus (-1 for seeds)
	FoundAt     time.Time
}

CorpusEntry is a single input in the corpus (like AFL's queue entry)

type CoverageGuidedFuzzer

type CoverageGuidedFuzzer struct {
	Target      string
	Method      string
	Body        string
	Headers     []string
	Cookies     string
	Proxy       string
	Timeout     int
	Points      []input.InjectionPoint
	Concurrency int

	// Callbacks
	OnNewCoverage func(entry CorpusEntry)
	OnCrash       func(entry CorpusEntry)
	// contains filtered or unexported fields
}

CoverageGuidedFuzzer is the AFL++-equivalent for web applications. Since we can't instrument the server binary, we use response characteristics as a coverage proxy: unique (status, body_hash, body_size_bucket, timing_bucket, error_class) tuples represent "new edges" in the server's behavior.

func New

func New(cfg Config) *CoverageGuidedFuzzer

func (*CoverageGuidedFuzzer) Fuzz

func (f *CoverageGuidedFuzzer) Fuzz(maxExecs int64, maxTime time.Duration) []CorpusEntry

Fuzz runs the coverage-guided evolutionary fuzzing loop. This is the core loop equivalent to AFL's fuzz_one().

func (*CoverageGuidedFuzzer) GetStats

func (f *CoverageGuidedFuzzer) GetStats() FuzzStats

GetStats returns current fuzzer statistics

func (*CoverageGuidedFuzzer) LoadCorpus

func (f *CoverageGuidedFuzzer) LoadCorpus(path string) error

LoadCorpus deserializes corpus entries from a JSON file

func (*CoverageGuidedFuzzer) SaveCorpus

func (f *CoverageGuidedFuzzer) SaveCorpus(path string) error

SaveCorpus serializes the corpus to a JSON file

func (*CoverageGuidedFuzzer) TestConnection

func (f *CoverageGuidedFuzzer) TestConnection() ResponseInfo

TestConnection verifies the target is reachable before fuzzing.

type FuzzStats

type FuzzStats struct {
	TotalExecs    int64
	TotalCoverage int
	CorpusSize    int
	CrashCount    int
	LastNewCov    time.Time
	ExecsPerSec   float64
	StartTime     time.Time
	CyclesDone    int
}

FuzzStats tracks fuzzer performance

type ResponseInfo

type ResponseInfo struct {
	StatusCode  int
	BodyLength  int
	BodyHash    string
	BodyPreview string // normalized body sample, used for simhash coverage
	TimingMs    int64
	ErrorClass  string
	Headers     map[string]string
	Interesting bool
}

ResponseInfo captures the server's behavior for an input