ameng929 / netFuzz

netFuzzTapor

This another fuzzer for netRequests how use

1. need install radamsa from https://github.com/aoh/radamsa

--dump <inputfile> --loop <loop_count> --address <remote_address> --port <port> --mode <fuzz_mode_dumb_0> --seed <fuzz_seed> --bypass <bypass_fuzz_pkg> --thread <fuzz_thread_count>

inputfile -> package or packages file in hex format like this (\n - separation packages char)

414141\n
424242\n
10111213\n

• -n -> mutation package count
• -o -> remote address
• -p -> remote port
• -m -> fuzz mode m = 0 for dumb fuzzing m = 1 for step-by-step fuzzing (use where need send handshake)
• -s -> fuzzing seed
• -b -> which package should be sent without the mutation

example

root@kali:~/Desktop/netFuzz# cat test.bin | hexdump
0000000 4141 4141 4141 4141 420a 4242 4242 4242
0000010 0a42

1. run netFuzz_testServer.py and listn 8080 port

2. run fuzzer with --dfile ./test.bin parametr

/usr/bin/python2.7 /root/Desktop/netFuzz/netFuzz_main.py --dfile ./test.bin
('Fuzz input file is ', './test.bin')
('Fuzz loop count ', 1)
('Fuzz address:port ', '192.168.213.1:8080')
Fuzz mode -m=1 step-by-step fuzzing,  -m=0 dumb fuzzing
('Fuzz seed ', '60906781022444159195513')
('Fuzz bypass package (experimental)', '10')

fuzzer will send to *:8080 2 package

New connection from 192.168.213.138
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�󠁟�AA�󠁟�AAAAAAAA
BBBBBBBB


New connection from 192.168.213.138
AAAAAAAA

BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB�󠁟�BB�󠁟�BBBBBBBB

founded

CVE	program	credit
CVE-2015-2819	Sybase SQL	vah_13 (ERPScan)
CVE-2015-2820	SAP Afaria	vah_13 (ERPScan)
CVE-2015-8330	SAP PCo agent	Mathieu GELI (ERPScan)
CVE-2016-1928	SAP HANA hdbxsengine	Mathieu Geli (ERPScan)
CVE-2016-3979	SAP NetWeaver	@ret5et (ERPScan)
CVE-2016-3980	SAP NetWeaver	@ret5et (ERPScan)
CVE-2016-4015	SAP NetWeaver	@vah_13 (ERPScan)