GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → Metalnem → Sharpfuzz

Metalnem / Sharpfuzz

Licence: mit
AFL-based fuzz testing for .NET

Labels

testingfuzzingfuzzerfuzz-testing

Projects that are alternatives of or similar to Sharpfuzz

Honggfuzz Rs
Fuzz your Rust code with Google-developed Honggfuzz !
Stars: ✭ 222 (+20%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Example Go
Go Fuzzit Example
Stars: ✭ 39 (-78.92%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Javafuzz
coverage guided fuzz testing for java
Stars: ✭ 193 (+4.32%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
Stars: ✭ 3,841 (+1976.22%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Aflplusplus
The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
Stars: ✭ 2,319 (+1153.51%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
fuzzuf
Fuzzing Unification Framework
Stars: ✭ 263 (+42.16%)
Mutual labels:  fuzzing, fuzz-testing, fuzzer
Ansvif
A Not So Very Intelligent Fuzzer: An advanced fuzzing framework designed to find vulnerabilities in C/C++ code.
Stars: ✭ 107 (-42.16%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Pythonfuzz
coverage guided fuzz testing for python
Stars: ✭ 175 (-5.41%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Fuzzdicts
Web Pentesting Fuzz 字典,一个就够了。
Stars: ✭ 4,013 (+2069.19%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Jsfuzz
coverage guided fuzz testing for javascript
Stars: ✭ 532 (+187.57%)
Mutual labels:  fuzzing, fuzzer, fuzz-testing
Afl Patches
Patches to afl to fix bugs or add enhancements
Stars: ✭ 76 (-58.92%)
Mutual labels:  fuzzing, fuzzer
Book
📖 Guides and tutorials on how to fuzz Rust code
Stars: ✭ 67 (-63.78%)
Mutual labels:  fuzzing, fuzz-testing
Burpsuite Collections
BurpSuite收集：包括不限于 Burp 文章、破解版、插件(非BApp Store)、汉化等相关教程，欢迎添砖加瓦---burpsuite-pro burpsuite-extender burpsuite cracked-version hackbar hacktools fuzzing fuzz-testing burp-plugin burp-extensions bapp-store brute-force-attacks brute-force-passwords waf sqlmap jar
Stars: ✭ 1,081 (+484.32%)
Mutual labels:  fuzzing, fuzz-testing
Afl.rs
🐇 Fuzzing Rust code with American Fuzzy Lop
Stars: ✭ 1,013 (+447.57%)
Mutual labels:  fuzzing, fuzz-testing
Janus
Janus: a state-of-the-art file system fuzzer on Linux
Stars: ✭ 139 (-24.86%)
Mutual labels:  fuzzing, fuzzer
Awesome Directed Fuzzing
A curated list of awesome directed fuzzing research papers
Stars: ✭ 77 (-58.38%)
Mutual labels:  fuzzing, fuzz-testing
Test Each
🤖 Repeat tests. Repeat tests. Repeat tests.
Stars: ✭ 89 (-51.89%)
Mutual labels:  fuzzing, fuzz-testing
Fisy Fuzz
This is the full file system fuzzing framework that I presented at the Hack in the Box 2020 Lockdown Edition conference in April.
Stars: ✭ 110 (-40.54%)
Mutual labels:  fuzzing, fuzzer
Crlf Injection Scanner
Command line tool for testing CRLF injection on a list of domains.
Stars: ✭ 91 (-50.81%)
Mutual labels:  fuzzing, fuzzer
Clusterfuzz Tools
Bugs are inevitable. Suffering is optional.
Stars: ✭ 111 (-40%)
Mutual labels:  fuzzing, fuzzer
View All Similar Projects ➔

SharpFuzz: AFL-based fuzz testing for .NET

NuGet Build Status License

SharpFuzz is a tool that brings the power of afl-fuzz to .NET platform. If you want to learn more about fuzzing, my motivation for writing SharpFuzz, the types of bugs it can find, or the technical details about how the integration with afl-fuzz works, read my blog post SharpFuzz: Bringing the power of afl-fuzz to .NET platform.

Table of contents

CVE

Blog posts

Trophies

If you find some interesting bugs with SharpFuzz, and are comfortable with sharing them, I would love to add them to this list. Please send me an email, make a pull request for the README file, or file an issue.

Requirements

AFL works on Linux and macOS. If you are using Windows, you can use any Linux distribution that works under the Windows Subsystem for Linux.

You will need GNU make and a working compiler (gcc or clang) in order to compile afl-fuzz. You will also need to have the .NET Core 2.1 or greater installed on your machine in order to instrument .NET assemblies with SharpFuzz.

Installation

You can install afl-fuzz and SharpFuzz.CommandLine global .NET tool by running the following script:

#/bin/sh
set -eux

# Download and extract the latest afl-fuzz source package
wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
tar -xvf afl-latest.tgz

rm afl-latest.tgz
cd afl-2.52b/

# Patch afl-fuzz so that it doesn't check whether the binary
# being fuzzed is instrumented (we have to do this because
# we are going to run our programs with the dotnet run command,
# and the dotnet binary would fail this check)
wget https://github.com/Metalnem/sharpfuzz/raw/master/patches/RemoveInstrumentationCheck.diff
patch < RemoveInstrumentationCheck.diff

# Install afl-fuzz
make install
cd ..
rm -rf afl-2.52b/

# Install SharpFuzz.CommandLine global .NET tool
dotnet tool install --global SharpFuzz.CommandLine

The alternative to patching afl-fuzz in order to skip the instrumentation check is to set the AFL_SKIP_BIN_CHECK environment variable.

Usage

This tutorial assumes that you are somewhat familiar with afl-fuzz. If you don't know anything about it, you should first read the AFL quick start guide and the afl-fuzz README. If you have enough time, I would also recommend reading Understanding the status screen and Technical whitepaper for afl-fuzz.

As an example, we are going to instrument Jil, which is a fast JSON serializer and deserializer (see SharpFuzz.Samples for many more examples of complete fuzzing projects).

1. Download the package from the NuGet gallery. You can do that by clicking the download package link in the info section of the page. The downloaded file will be called jil.2.16.0.nupkg.

2. Change the extension of the downloaded file from nupkg to zip, and then extract it. The location of the assembly we are going to instrument will be jil.2.16.0/lib/netstandard2.0/Jil.dll. We could have chosen some other .NET platform, such as net45 or netstandard1.6, but the latest version of .NET Standard is usually the best choice.

3. Instrument the assembly by running the sharpfuzz tool with the path to the assembly as a parameter. In our case, the exact command looks like this:

sharpfuzz jil.2.16.0/lib/netstandard2.0/Jil.dll

The instrumentation is performed in place, which means that jil.2.16.0/lib/netstandard2.0/Jil.dll will contain the instrumented version of Jil after running this command.

4. Create a new .NET console project, and add the instrumented library to it, along with all of its dependencies. To do that, copy Jil.dll to the root directory of the project, and then add the following element to your project file:

<ItemGroup>
  <Reference Include="Jil">
    <HintPath>Jil.dll</HintPath>
  </Reference>
</ItemGroup>

Jil depends on Sigil, which is why you also have to manually add the reference to Sigil. You can install it from NuGet with the following command:

dotnet add package Sigil --version 4.7.0

5. Add the SharpFuzz package to the project by running the following command:

dotnet add package SharpFuzz

6. Now it's time to write some code. The Main function should call the SharpFuzz.Fuzzer.Run with the function that we want to test as a parameter. Here's the one possible way we could write this:

using System;
using System.IO;
using SharpFuzz;

namespace Jil.Fuzz
{
  public class Program
  {
    public static void Main(string[] args)
    {
      Fuzzer.Run(stream =>
      {
        try
        {
          using (var reader = new StreamReader(stream))
          {
            JSON.DeserializeDynamic(reader);
          }
        }
        catch (DeserializationException) { }
      });
    }
  }
}

We want to fuzz the deserialization capabilities of Jil, which is why we are calling the JSON.DeserializeDynamic method. The input data will be be provided to us via the stream parameter (if the code you are testing takes its input as a string, you can use an additional overload of Fuzzer.Run that accepts Action<string>).

If the code passed to Fuzzer.Run throws an exception, it will be reported to afl-fuzz as a crash. However, we want to treat only unexpected exceptions as bugs. DeserializationException is what we expect when we encounter an invalid JSON input, which is why we catch it in our example.

7. Create a directory with some test cases (one test is usually more than enough). Test files should contain some input that is accepted by your code as valid, and should also be as small as possible. For example, this is the JSON I'm using for testing JSON deserializers:

{"menu":{"id":1,"val":"X","pop":{"a":[{"click":"Open()"},{"click":"Close()"}]}}}

8. You are now ready to go! Build the project with dotnet build, and start the fuzzing with the following command:

afl-fuzz -i testcases_dir -o findings_dir -t timeout \
  dotnet path_to_assembly

Let's say that our working directory is called Fuzzing. If it contains the project Fuzzing.csproj, and the directory called Testcases, the full command might look like this:

afl-fuzz -i Testcases -o Findings -t 5000 \
  dotnet bin/Debug/netcoreapp2.1/Fuzzing.dll

It's highly recommended that you always specify the timeout (5000ms from the previous example is a good choice), otherwise you will often get false crash reports because AFL uses automatic timeout calculation, which is too sensitive and unsuitable for managed languages.

For formats such as HTML, JavaScript, JSON, or SQL, the fuzzing process can be greatly improved with the usage of a dictionary file. AFL comes with bunch of dictionaries, which you can find after installation in /usr/local/share/afl/dictionaries/. With this in mind, we can improve our fuzzing of Jil like this:

afl-fuzz -i Testcases -o Findings -t 5000 \
  -x /usr/local/share/afl/dictionaries/json.dict \
  dotnet bin/Debug/netcoreapp2.1/Fuzzing.dll

Sometimes you may encounter the following error when running afl-fuzz:

[-] Oops, the program crashed with one of the test cases provided. There are
    several possible explanations:

This usually happens when some of your provided test inputs cause the fuzzing function to throw an exception, but sometimes this can happen due to low default memory limit (I see this very often in the cloud environment). You can fix it by increasing the memory limit for your program to some large value:

afl-fuzz -i testcases_dir -o findings_dir -t 5000 -m 10000 \
  dotnet path_to_assembly

9. Sit back and relax! You will often have some useful results within minutes, but sometimes it can take more than a day, so be patient.

The input files responsible for unhandled exceptions will appear in findings_dir/crashes. The total number of unique crashes will be displayed in red on the afl-fuzz status screen.

In practice, the real number of unique exceptions will often be much lower than the reported number, which is why it's usually best to write a small program that just goes through the crashing inputs, runs the fuzzing function on each of them, and saves only the inputs that produce unique stack traces.

Advanced topics

Acknowledgements

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].