OT: Is there a simple, little fuzzer that just uses grammars as templates for their outputs?
Yes, lots and lots and lots of them. Peach is the most popular example.
"a simple, little fuzzer"
The download for Peach is 190MB??
Pulling JPEGs out of thin air
71–80 of 86 posts
Re: Pulling JPEGs out of thin air
#72Earlier quoted context omitted.
Mock it locally, exploit it globally. One more reminder why it's useful to turn off your server signatures, especially if they spew out version information.
Oh ho ho no you don't. That's security through obscurity, and that's never ever OK for anybody. I never understood this attitude. It has always been my experience that obscurity is in fact an important part of security. It's a weakness when mistaken for security, not when understood as part of it. Sadly, I do actually have signatures (with version information) to mute.
People knee-jerk say that because they assume it's the only thing being done to secure an asset, when obviously it's a valid defense in depth measure, one with very low marginal cost (setting a few variables in conf files).
Re: Pulling JPEGs out of thin air
#73The author of this article is a hacker from the time, when the word hacker meant something different than it does today. I remember his website from my early teens when I started using the internet via a dial-up connection back in 1998. Lcamtuf, glad to see you're still around. Your fellow countryman.
Re: Pulling JPEGs out of thin air
#74Earlier quoted context omitted.
Oh ho ho no you don't. That's security through obscurity, and that's never ever OK for anybody. I never understood this attitude. It has always been my experience that obscurity is in fact an important part of security. It's a weakness when mistaken for security, not when understood as part of it. Sadly, I do actually have signatures (with version information) to mute.
People knee-jerk say that because they assume it's the only thing being done to secure an asset, when obviously it's a valid defense in depth measure, one with very low marginal cost (setting a few variables in conf files).
This really depends. The marginal cost of "what version is this box running, why doesn't this work, oh we don't have that tool?" could be very high on something like that.
I mean remembering, that the net is full of slow brute-forcers and the like. Just because it takes a few days to run through all the exploits doesn't mean that someone won't do it - that's thinking of security in human, individual terms, as though the threat is targeted rather then general.
Re: Pulling JPEGs out of thin air
#75Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Symbolic_execution Quite possible. More commonly done with higher-level languages rather than machine code, but certainly possible with machine code. A good fuzzer could do this too. The fuzzer from the article, american-fuzzy-lop ( https://code.google.com/p/american-fuzzy-lop/ ), does something similar to this as it moves forward in execution, trying to find interesting inputs that caus…
Yea I thought of hashes too. Because there are hashes proven (?) to be secure, it follows that it's impossible to make a universally efficient fuzzer (i.e. one that necessarily spends much less than ~exp(parser size) time).
There are no hashes that are proven to be secure.
And we aren't likely to get such a proof any time soon: secure hashes can only exist if P != NP.
Re: Pulling JPEGs out of thin air
#76Earlier quoted context omitted.
If you are trying to fuzz a protocol, there is no reason not to test it on a local machine. And it would probably end up _faster_ than the jpeg example because a network request has less overhead than execvp.
Only if you're capable of running the server on the local machine. So yeah, you could fuzz open-source software this way, but that's only going to test the underlying transport protocol, e.g. testing HTTP for nginx. When talking about bringing down services, you presumably need to attack the service itself, and that typically means attacking a server whose code you don't have access to. Open-source services that are…
Doesn't have to be open source. Just cause you don't have the source or its not free doesn't mean you can't still fuzz it. Though If some company is running some home brew solution then yes. But plenty of people run services based upon technologies that are semi widely available. Even if not open source.
Re: Pulling JPEGs out of thin air
#77Potential instructions for trying this on Mac (I was unable to make it work, perhaps we can build upon this): curl -LO http://lcamtuf.coredump.cx/afl.tgz tar zxvf afl.tgz rm afl.tgz cd afl* make afl-gcc make afl-fuzz mkdir in_dir echo 'hello' >in_dir/hello # there is a glitch with the libjpeg-turbo-1.3.1 configure file that makes it difficult to compile on Mac, so I tried regular libjpeg: curl -LO http://www.ijg.org/…
Hello,
Install homebrew if you don't have it already, then
brew install gcc
CC=gcc-4.9 make clean all
However, we then get stuck as djpeg is a shell file (and .libs/djpeg exits with error 5) and I've got a bit distracted to continue. Good luck!
Re: Pulling JPEGs out of thin air
#78What if we feed afl a program that checks whether a number is prime? Will it slowly discover a way to make primes?
Re: Pulling JPEGs out of thin air
#79Earlier quoted context omitted.
Only if you're capable of running the server on the local machine. So yeah, you could fuzz open-source software this way, but that's only going to test the underlying transport protocol, e.g. testing HTTP for nginx. When talking about bringing down services, you presumably need to attack the service itself, and that typically means attacking a server whose code you don't have access to. Open-source services that are…
Doesn't have to be open source. Just cause you don't have the source or its not free doesn't mean you can't still fuzz it. Though If some company is running some home brew solution then yes. But plenty of people run services based upon technologies that are semi widely available. Even if not open source.
True, you don't need the source, but you do need the service. And my point was that the software you can run are the software providing the underlying support for the service (e.g. HTTP handling with Nginx, databases with Mysql, etc), and is not the service directly.
Re: Pulling JPEGs out of thin air
#80Regarding >if (strcmp(header.magic_password, "h4ck3d by p1gZ")) goto terminate_now; How impossible would it be to look at the branching instruction, perform a taint analysis on its input and see if there is any part of the input we can tweak to make it branch/not branch. Like, we jumped because the zero flag was set. And the zero flags was set because these two bytes were equal. Hmm that byte is hardcoded. This other…
https://en.wikipedia.org/wiki/Symbolic_execution Quite possible. More commonly done with higher-level languages rather than machine code, but certainly possible with machine code. A good fuzzer could do this too. The fuzzer from the article, american-fuzzy-lop ( https://code.google.com/p/american-fuzzy-lop/ ), does something similar to this as it moves forward in execution, trying to find interesting inputs that caus…
I guess one solution could be to give up if the computation becomes too complicated.
>The left side was computed by summing this and this. That was in turn computed by xoring that and... Screw it. The left side can not be controlled. Now, the right side was loaded from this part of the file. Aha! Let's just change that part instead.