Re: [Video] sickfuzz v0.2
My My, you have been a busy beaver haven't you. I'll have to look into this, I haven't checked out your blog in awhile..it's on my to do list, but with everything going on, well..you know. One thing though on the topic. What does sickfuzz do that spike can't do? To me its a fuzzer that your using wireshark or tshark? to do http fuzzing. I'm going to assume the purpose of this is developing bof's..but not sure.
Securityxxxpert
Re: [Video] sickfuzz v0.2
Quote:
Originally Posted by
securityxxxpert
My My, you have been a busy beaver haven't you. I'll have to look into this, I haven't checked out your blog in awhile..it's on my to do list, but with everything going on, well..you know. One thing though on the topic. What does sickfuzz do that spike can't do? To me its a fuzzer that your using wireshark or tshark? to do http fuzzing. I'm going to assume the purpose of this is developing bof's..but not sure.
Securityxxxpert
Hmmm, well if you check g0tmi1ks post carefully you might notice this:
Quote:
You can read what hes got to say about it
here.
Also you ask what does sickfuzz do what spike can't do, if you ever tried spike you know that it's a fuzzing framework, you have to tell it what to fuzz. sickfuzz also includes custom .spk scripts to use in the fuzzing process.
Re: [Video] sickfuzz v0.2
great work guys :D ,,, really like it , am gonna try
go fw boys
Re: [Video] sickfuzz v0.2
very nice! congrats both of ya (re: sickness & g0tmi1k) - enjoyed the vid and grabbin' sickfuzz now :D
Re: [Video] sickfuzz v0.2
worked great
got a crash on my first try - There goes the rest of my week. :)
Re: [Video] sickfuzz v0.2
Quote:
Originally Posted by
securityxxxpert
My My, you have been a busy beaver haven't you. I'll have to look into this, I haven't checked out your blog in awhile..it's on my to do list, but with everything going on, well..you know. One thing though on the topic. What does sickfuzz do that spike can't do? To me its a fuzzer that your using wireshark or tshark? to do http fuzzing. I'm going to assume the purpose of this is developing bof's..but not sure.
Securityxxxpert
sickness did all the hard work as he is the creator of it - I just made the video. :)
sickfuzz controls spike which helps automate it all. Sickfuzz also comes with some custom stuff + useful features (port & statues checking for example).
Wireshark was used during the video to show data is being sent from sickfuzz (because of spike). It can then be used to analyse in detail what cause the crash afterwords.
and Yes, fuzzing it a method of developing exploits. Here is a good break down of it all: http://www.pentest-standard.org/index.php/Exploitation
Quote:
Originally Posted by
m0j4h3d
great work guys :D ,,, really like it , am gonna try
go fw boys
Quote:
Originally Posted by
fnord0
very nice! congrats both of ya (re: sickness & g0tmi1k) - enjoyed the vid and grabbin' sickfuzz now :D
Quote:
Originally Posted by
Scamentology
worked great
got a crash on my first try - There goes the rest of my week. :)
Thanks for the thanks!
Great to hear feedback on it all! =)
hehe Scamentology, sorry about that - Best of luck with it!
Re: [Video] sickfuzz v0.2
sickfuzz v0.3 is out!
Download link: http://code.google.com/p/sickfuzz/downloads/list
svn checkout http://sickfuzz.googlecode.com/svn/trunk/ sickfuzz
New features:
- Some SPIKE tweak.
- Changed the SPIKE fuzzer.
- Modified the .spk scripts.
- More logs available.
- More detailed help screen as well as output.
Fixed bugs:
- Fixed tailing issue, now paths don't have to end with "/".
- Now stops when app crashes without going over the other scripts.
Install SPIKE and sickfuzz:
Code:
root@bt:~# apt-get install automake
root@bt:~# rm -rf /pentest/fuzzers/spike/
root@bt:~# wget -P /tmp http://www.immunitysec.com/downloads/SPIKE2.9.tgz
root@bt:~# tar xvzf /tmp/SPIKE2.9.tgz -C /pentest/fuzzers && rm /tmp/SPIKE2.9.tgz
root@bt:~# cd /pentest/fuzzers/SPIKE/SPIKE/src/
Before actually starting to compile SPIKE we will make a little tweak (thank master @lupin for this one!).
Open up spike.c, there are 2 lines that look like this:
Code:
printf("tried to send to a closed socket!\n");
Each of these 2 lines contains a "return 0;" instruction on the next line, we will replace this instruction with "exit(1);" save the file and proceed.
(NOTE: ONLY REPLACE THOSE 2 INSTRUCTIONS NOT ALL!)
http://img156.imageshack.us/img156/6...shot1eu.th.png
http://img4.imageshack.us/img4/1401/snapshot2lr.th.png
http://img864.imageshack.us/img864/6...pshot3a.th.png
http://img689.imageshack.us/img689/2...pshot4g.th.png
Now we can proceed with SPIKE:
Code:
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# aclocal
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# automake
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# ./configure
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# sed -i 's/CFLAGS = -Wall -funsigned-char -c -fPIC -ggdb/CFLAGS = -Wall -funsigned-char -c -fPIC -ggdb -fno-stack-protector/g' Makefile
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# make
If you get this error:
Code:
configure: creating ./config.status
cd && /bin/sh ./config.status Makefile
/bin/sh: ./config.status: No such file or directory
make: *** [Makefile] Error 127
Execute the following commands again:
Code:
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# aclocal
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# automake
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# ./configure
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# sed -i 's/CFLAGS = -Wall -funsigned-char -c -fPIC -ggdb/CFLAGS = -Wall -funsigned-char -c -fPIC -ggdb -fno-stack-p$
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# make
Should have worked now.
Code:
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# mv -f /pentest/fuzzers/SPIKE/SPIKE/src /pentest/fuzzers/spike/
root@bt:/pentest/fuzzers/SPIKE/SPIKE/src# cd
root@bt:~# rm -rf /pentest/fuzzers/SPIKE/
root@bt:~# cd /pentest/fuzzers/
root@bt:/pentest/fuzzers# svn checkout http://sickfuzz.googlecode.com/svn/trunk sickfuzz
For more info on using SPIKE check out lupin's guides:
http://resources.infosecinstitute.com/intro-to-fuzzing/
http://resources.infosecinstitute.co...on-with-spike/
Re: [Video] sickfuzz v0.2
Whew!!! that was NICE ! ;)
