ffw - GitLite

KO | EN

gitlite — search

#javascript #python #react #ai #typescript #go #android #deep-learning #nodejs #macos #awesome #vue #security #open-source

ffw

(★ 122)

A fuzzing framework for network servers

파일 탐색기

최종 버전 다운로드 (.zip)

- __init__.py
- basicmaster.py
- basicslave.py
- __init__.py
- clientfuzzermaster.py
- clientfuzzerserver.py
- clientfuzzerslave.py
- clientmanager.py
- __init__.py
- corpusdata.py
- corpusmanager.py
- crashdata.py
- crashmanager.py
- ffwfile.py
- networkdata.py
- verifydata.py
- verifymanager.py
- notes.md
- tutorial-grammar-based.md
- tutorial-honggmode.md
- tutorial-sample-project.md
- __init__.py
- honggcomm.py
- honggcorpusdata.py
- honggcorpusmanager.py
- honggmaster.py
- honggslave.py
- honggstats.py
- __init__.py
- mutator_cmiller.py
- mutator_dictionary.py
- mutator_dumb.py
- mutator_list.py
- mutatorinterface.py
- __init__.py
- interceptor.py
- networkmanager.py
- proto_vnc.py
- replay.py
- tester.py
- __init__.py
- servermanager.py
- targetutils.py
- __init__.py
- interceptorclientmockup.py
- interceptorservermockup.py
- mockup_simplebind.py
- mockupfuzzer.py
- test_corpusfile.py
- test_crashdata.py
- test_crashmanager.py
- test_dictionaryfuzzer.py
- test_fuzzer.py
- test_honggcorpusmanager.py
- test_honggfuzz.py
- test_honggstats.py
- test_interceptor.py
- test_namespace.py
- test_verifydata.py
- test_verifymanager.py
- testutils.py
- - README.txt
- - README.txt
- - README.txt
- - README.txt
- - README.txt
- clienttest.c
- fuzzing.py
- Makefile
- __init__.py
- uploader.py
- __init__.py
- abstractverifierservermanager.py
- asanparser.py
- debugservermanager.py
- gdbservermanager.py
- minimizer.py
- servercrashdata.py
- verifier.py
- - coverageserver.c
  - Makefile
  - vulnserver.c
  - vulnserver_client.py
- config.py
- intercept0.pickle
- Makefile
.gitignore
classdiagram.md
configmanager.py
convertdata.py
corpusparser.py
defaultconfig.py
ffw.py
framework.py
gui.py
hexdump.py
LICENSE
make-dictionary.sh
printpickle.py
README.md
requirements.txt
tweet.conf.example
twitterinterface.py
utils.py

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# FFW - Fuzzing For Worms

Fuzzes network servers/services by intercepting valid network
communication data, then replay it with some fuzzing.

FFW can fuzz open source applications and supports feedback driven fuzzing
by instrumenting honggfuzz, for both open- and closed source apps.

In comparison with the alternatives, FFW is the most advanced,
feature-complete and tested network fuzzer.

Features:
* Fuzzes all kind of network protocol (HTTP, MQTT, SMTP, you name it)
* No modification of the fuzzing target needed (at all)
* Has feedback-driven fuzzing (with compiler support, or hardware based)
* Can fuzz network clients too (wip)
* Fast fuzzing setup (no source code changes or protocol reversing needed!)
* Reasonable fuzzing performance

# Presentation

Presented at security conference Area 41 2018. 
* (Fuzzing For Worms Slides)[https://docs.google.com/presentation/d/1tLELphbkh2bVLyIedagNoFKBn_DEYv29RskZY4u-szA/edit?usp=sharing]
* (Youtube)[https://www.youtube.com/watch?v=akpk9hrizc4]

# Docker

Easiest way to start is to use the docker image:
* https://github.com/dobin/ffw-docker

By doing so:
```
docker run -ti --privileged -lxc-conf="aa_profile=unconfined" dobin/ffw:0.1
```

Examples are located in `/ffw-examples`.

# Manual Installation

## Get FFW

```
git clone https://github.com/dobin/ffw.git
cd ffw/
```

Note: Manually installed dependencies are expected to live in
the `ffw/` directory (e.g. honggfuzz, radamsa).

## Install FFW dependencies

If its a fresh Ubuntu, install relevant packages for FFW:
```
apt-get install python python-pip gdb
```

For honggfuzz:
```
apt-get install clang binutils-dev libunwind8-dev
```

And python dependencies:
```
pip install -r requirements.txt
```

## Install Radamsa fuzzer

```
$ git clone https://github.com/aoh/radamsa.git
$ cd radamsa
$ make
```

Default Radamsa directory specified in ffw is `ffw/radamsa`.

# Setup a project

Steps involved in setting up a fuzzing project:

* Create directory structure for that fuzzing project by copying template folder
* Copy target binary to bin/
* Specify all necessary information in the config file fuzzing.py
* Start interceptor-mode to record traffic
* Start test-mode to verify recorded traffic (optional)
* Start fuzz-mode to fuzz
* Start verify-mode to verify crashed from the fuzz mode (optional)
* Start upload-mode to upload verified crashes to the web (optional)

For a step-by-step guide:
* [Setup the sample project tutorial](https://github.com/dobin/ffw/blob/master/docs/tutorial-sample-project.md)
* [Setup the feedback-driven fuzzing project tutorial](https://github.com/dobin/ffw/blob/master/docs/tutorial-honggmode.md)
* [Some fuzzing help and infos](https://github.com/dobin/ffw/blob/master/docs/notes.md)

# Unit Tests

Test all:

```
python -m unittest discover
```

Test a single module:
```
python -m unittest test.test_interceptor
```

# Alternatives

## Fuzzotron

Available via https://github.com/denandz/fuzzotron. "Fuzzotron is a simple network fuzzer supporting TCP, UDP and multithreading."

Support network fuzzing, also uses Radamsa. Can use coverage data, but it is experimental.

Con's:
* Does not restart target server
* Unreliable crash detection
* Experimental code coverage

## Mutiny

Available via https://github.com/Cisco-Talos/mutiny-fuzzer. "The Mutiny Fuzzing Framework is a network fuzzer that operates by replaying PCAPs through a mutational fuzzer."

Con's:
* No code coverage
* Only one commit (no development?)
* Rudimentary crash detection