The Python Fuzzer That The World Deserves

graph TB
m1(Mutation 1) --> |enter| perform(Fuzzed perform)
m2(Mutation 2) --> |enter| perform(Fuzzed perform)
mplus(Mutation ...) --> |enter| perform(Fuzzed perform)
mn(Mutation n) --> |enter| perform(Fuzzed perform)
perform --> generate_reports(Generate experiences)
generate_reports --> rank_reports(Rank experiences)  
rank_reports --> choose(Choose n finest experiences)
choose --> |mutate| nm1(Mutation 1) & nm2(Mutation 2) & nmplus(Mutation ...) & nmn(Mutation n)
subgraph Cycle mutations
route LR
m1
m2
mplus
mn
finish
subgraph Subsequent cycle mutations
route LR
nm1
nm2
nmplus
nmn
finish
type perform fill:#5388e8,stroke:white,stroke-width:4px

Options

Fuzzing totally different argument sorts:

• String
• Int
• Float
• Listing
• Tuple
• Dictionary

File fuzzing

Frelatage permits to fuzz a perform by passing a file as enter.

Fuzzer effectivity

Use Frelatage

Fuzz a classical parameter

import frelatage
import my_vulnerable_library
def MyFunctionFuzz(information):
my_vulnerable_library.parse(information)
enter = frelatage.Enter(worth="initial_value")
f = frelatage.Fuzzer(MyFunctionFuzz, [[input]])
f.fuzz()

Fuzz a file parameter

Frelatage provides you the likelihood to fuzz file sort enter parameters. To initialize the worth of those information, you should create information within the enter folder (./in by default).

If we need to initialize the worth of a file used to fuzz, we are able to do it like this:

echo "preliminary worth" > ./in/enter.txt

After which run the fuzzer:

import frelatage
import my_vulnerable_library
def MyFunctionFuzz(information):
my_vulnerable_library.load_file(information)
enter = frelatage.Enter(file=True, worth="enter.txt")
f = frelatage.Fuzzer(MyFunctionFuzz, [[input]])
f.fuzz()

Load a number of information to a corpus without delay

If it is advisable to load a number of information right into a corpus without delay (helpful if you happen to use a big corpus) You need to use the built-in perform of Frelatage load_corpus. This perform returns a listing of inputs.

load_corpus(listing: str, file_extensions: record) -> record[Input]

• listing: Subdirectory of the enter listing (relative path), e.g ./, ./photos
• file_extensions: Listing of file extensions to incorporate within the corpus entries, e.g. ["jpeg", "gif"], ["pdf"]

import frelatage
import my_vulnerable_library
def MyFunctionFuzz(information):
my_vulnerable_library.load_file(information)
my_vulnerable_library.load_file(data2)
# Load each each file within the ./in listing
corpus_1 = frelatage.load_corpus(listing="./")
# Load each .gif/.jpeg file within the ./in/photos subdirectory
corpus_2 = frelatage.load_corpus(listing="./photos", file_extension=["gif", "jpeg"])
f = frelatage.Fuzzer(MyFunctionFuzz, [corpus_1, corpus_2])
f.fuzz()

Fuzz with a dictionary

You may copy a number of dictionaries situated right here within the listing devoted to dictionaries (./dict by default).

Differential fuzzing

Differental fuzzing is a well-liked software program testing method that makes an attempt to detect bugs by offering the identical enter to a number of libraries/applications and observing variations of their behaviors. One can find an instance right here of a use of differential fuzzing with Frelatage with the json and ujson libraries.

Examples

Yow will discover extra examples of fuzzers and corpus within the examples listing.

Experiences

Every crash is saved within the output folder (./out by default), in a folder named : id:<crash ID>,err:<error sort>,err_pos:<error>,err_file:<error file>.

The report listing is within the following type:

    ├── out
│   ├── id:<crash ID>,err:<error sort>,err_file:<error file>,err_pos:<err_pos>
│       ├── enter
│       ├── 0
│            ├── <inputfile1>
│       ├── ...
│   ├── ...

Learn a crash report

Inputs handed to a perform are serialized utilizing the pickle module earlier than being saved within the <report_folder>/enter file. It’s subsequently essential to deserialize it to have the ability to learn the contents of the file. This motion might be carried out with this script.

Configuration

There are two methods to arrange Frelatage:

Utilizing the atmosphere variables

A configuration instance :

export FRELATAGE_DICTIONARY_ENABLE=1 &&
export FRELATAGE_TIMEOUT_DELAY=2 &&
export FRELATAGE_INPUT_FILE_TMP_DIR="/tmp/frelatage" &&
export FRELATAGE_INPUT_MAX_LEN=4096 &&
export FRELATAGE_MAX_THREADS=8 &&
export FRELATAGE_MAX_CYCLES_WITHOUT_NEW_PATHS=5000 &&
export FRELATAGE_INPUT_DIR="./in" &&
export FRELATAGE_DICTIONARY_DIR="./dict" &&
python3 fuzzer.py

Passing arguments to the fuzzer

import frelatage 
def myfunction(input1_string, input2_int):
go
input1 = frelatage.Enter(worth="initial_value")
input2 = frelatage.Enter(worth=2)
f = frelatage.Fuzzer(
# The strategy you need to fuzz
technique=myfunction,
# Corpus
corpus=[[input1], [input2]],
# Variety of threads
threads_count=8,
# Exceptions that will probably be taken into consideration
exceptions_whitelist=(OSError),
# Exceptions that won't be taken into consideration
exceptions_blacklist=(),
# Listing the place the error experiences will probably be saved
output_directory="./out",
# Allow or disable silent mode
silent=False
)
f.fuzz()

Dangers

Please take into account that, equally to many different computationally-intensive duties, fuzzing might put pressure in your {hardware} and on the OS. Specifically:

• Your CPU will run scorching and can want sufficient cooling. Most often, if cooling is inadequate or stops working correctly, CPU speeds will probably be robotically throttled. That stated, particularly when fuzzing on much less appropriate {hardware} (laptops, smartphones, and many others), it is not fully unattainable for one thing to explode.

• Focused applications might find yourself erratically grabbing gigabytes of reminiscence or filling up disk house with junk information. Frelatage tries to implement primary reminiscence limits, however cannot forestall each attainable mishap. The underside line is that you simply should not be fuzzing on methods the place the prospect of information loss will not be a suitable danger.

• Fuzzing includes billions of reads and writes to the filesystem. On trendy methods, this will probably be often closely cached, leading to pretty modest “bodily” I/O – however there are various elements that will alter this equation. It’s your accountability to watch for potential hassle; with very heavy I/O, the lifespan of many HDDs and SSDs could also be decreased.

  A great way to watch disk I/O on Linux is the ‘iostat’ command:

    $ iostat -d 3 -x -k [...optional disk ID...]

About Me/Rent me

I’m Rog3rSm1th, I’m 21 years previous and I am a French laptop and cybersecurity fanatic. I like growing instruments (OSINT, Fuzzing…) and taking part in CTFs/Wargames. To study extra about me and my tasks, juste click on right here.

➜ If you wish to rent me for one among your tasks (Programming, cybersecurity…), simply contact me at [email protected] and we are going to assess your wants collectively.

Contact

for any comment, suggestion, bug report, or if you happen to discovered a bug utilizing Frelatage, you possibly can contact me at [email protected] or on twitter @Rog3rSm1th