karust / ml_http_fuzzer

HTTP Fuzzer based on transformer ML model

ML HTTP Fuzzer

HTTP Fuzzer backed with Machine Learning. The concept is shown on fuzzing of a server HTTP headers. More explanation to the idea can be found here.

Installation

pip3 install -r requirements.txt

or

docker pull uranusq/ml_fuzz

Usage

• Newline-separated URLs in file:

python main.py -f ./data/test_urls.txt

• Single URL usage with debug output:

python main.py -u https://youtube.com -d

Debug output also contains model predictions. Example output:

• Docker usage:

docker run -it uranusq/ml_fuzz -u https://instagram.com -d

Project files

• ./data - contains CSV datasets and Burp output
• ./save - pretrained models and vocabulary
• main.py - proof of concept
• fuzzer.py - fuzzer implementation
• burpParser.py - used to parse Burp .XML output
• transformer.py - Transformer architecture and model interface
• train.py - preparing data and training the model
• utils.py - auxiliary functions