Bug Hunting and Exploit Development 2: Finding Flaws Using Fuzzing 1
Channel: Z. Cliffe Schreuders
Date: 2015-06-22

This video is part of the computer/information/cyber security and ethical hacking lecture series; by Z. Cliffe Schreuders at Leeds Beckett University. Laboratory work sheets, slides, and other open educational resources are available at http://z.cliffe.schreuders.org. 

The slides themselves are creative commons licensed CC-BY-SA, and images used are licensed as individually attributed.

Topics covered in this lecture include:
Fuzzers
Fuzz testing, AKA fuzzing: feeding in variations of unexpected input into a program in an attempt to uncover unexpected behaviour
Fuzzers are often used by security researchers to find new vulnerabilities in software
Can be used for black-box testing
Or white or grey-box testing
What to fuzz?
What kinds of data are worth testing? What data do you trust is valid?
What to fuzz?
What kinds of data are worth testing? What data do you trust is valid?
Everything external to the program code!
Especially if it crosses a trust boundary
Examples of things to fuzz:
Network protocols, such as service requests
File formats
API calls
Environment variables
Approaches to fuzzing
Simple fuzzing: Feed in input of increasing sizes into a program
The input may include sequences designed to trigger problems, such as special characters
Mutation: takes a standard input/protocol and makes incremental changes
Change sections of input at random
The more aware of the protocol expectations the better (for example, maintaining “Content Length” headers)
FOSS Fuzzers
Spike: popular framework for specifying fuzzers 
Sully: network only, similar to Spike
Peach: includes many advanced features, can restart crashed targets, most active development, files, input, or network (one of the best options for fuzzing, with a slightly steeper learning curve)
MSF auxiliary/fuzzers: custom fuzzers built on MSF
More on Spike...
Spike
Spike: a framework for specifying fuzzers using Spike files
Popular, has been in use for a long time
Written in C
Particularly suited to command input and network fuzzing
Not well documented, and not in active development
However, it is fairly straightforward to use, and it can be very effective at finding shallow bugs
A Spike file
A Spike file (.spk) is a template for fuzzing, made up of commands
s_string("Hello, world!"); 
sends a string
s_string_variable("Hello, world!"); 
fuzzes a string
s_readline(); 
reads and displays a line of response
spike_send(); sends what is in the buffer now
printf(); writes to the local console
A Spike file
A Spike file can be launched against a network port or a program using one of Spike's interpreters
generic_send_tcp:
Usage: ./generic_send_tcp host port spike_script SKIPVAR SKIPSTR
For example:
generic_send_tcp IP-address 4444 my_first_spike.spk 0 0
The first number is the fuzzing variable (such as string_variable) to skip to, and the second number is the fuzzing iteration to skip to for that variable
A Spike file
In order to fuzz more complex programs, the spike script file needs to have added complexity to send certain parts of the input as expected, and focus on fuzzing the inputs that are most likely to trigger flaws:
Altering input lengths and command options
Altering integers, to test for boundary conditions and outliers
Command injections, invalid characters and so on