The sulley fuzzing framework! (A basic example walkthrough)

This is a short demonstration on using the sulley fuzzing framework. I'll be fuzzing an application with a known bug (for obvious reasons...) that has already been exploited.(http://packetstormsecurity.org/advisories/misc/savant.overflow.txt) I chose a basic plan-text HTTP server just for demonstration purposes. This is not a protocol fuzzing tutorial. Anyway, I've tried pretty much all of the fuzzers worth using. I decided to give this project a try and I must say I'm pretty impressed with it. It's a block based protocol fuzzer similar to SPIKE. Seems to be a little bit more robust and a little less tedious since you don't have to recompile anything after your done coding mainly. It's python based which isn't my primary language. (I'm a C/++ guy) I just started to finally sit down and learn some kind of fuzzing framework to automate and streamline the process of finding bugs. I've just started to get into writing exploits and need a nice fuzzer that I can start finding bugs with so I went with sulley. Has decent documentation I guess. Not many examples however. Theres a couple in the "archived_fuzzies" folder though. The nice thing about it is that it has a network / process monitor with a built in debugger that dumps wire captures as well as crash dumps. This is a pretty cheesy example but It's just to give you an idea of how it works...

Definition of fuzz testing:

http://en.wikipedia.org/wiki/Fuzz_testing

Sulley download url:

http://www.fuzzing.org/wp-content/Sulley%20Fuzzing%20Framework.exe

PDF:

http://www.fuzzing.org/wp-content/SulleyManual.pdf

This should help to get you started making your own protocol fuzzers using this wonderful framework. Enjoy :)

PLEASE RATE!

NOTE: You can now follow me on Twitter for video/ and project activity updates: http://twitter.com/xsploitedsec/

Category:

Science & Technology

Tags:

• sulley
• fuzzing
• fuzzer
• finding
• exploit
• vulnerabilities
• automated
• hacking
• backtrack
• linux
• fuzzing framework
• fuzzing with sulley

[xsploitedsecurity]

Thanks for comments. Nice to know people actually enjoy my videos and can learn from them. In this case, I plan to release more in the near future. ;)

[xNORZE]

5 * and subscribe

briliant videos

[xsploitedsecurity]

Thank you.

[getuniquee]

pretty good session.. im diggin it, nice work

[xsploitedsecurity]

@getuniquee Thanks bro :)

[storiginal]

Well presented. Look forward to seeing more on your blog. Thanks! :)

[JurkoffJay]

@weekend4lust

I wish I knew what the heck this all ment. Who did you become a computer hacker?

[liulinyang]

Thanks for sharing. it's really helpful.

[heaveninflames]

Nice, thanks for this :)

[kaotixcrew]

Best tutorial to date. I'll bf that notion