[test suite] AFL README -> README.md
This commit is contained in:
Michael Rash
@@ -1,77 +0,0 @@
|
||||
|
||||
# Fuzzing fwknop With American Fuzzy Lop (AFL)
|
||||
|
||||
## Quick Start
|
||||
|
||||
To get going with AFL fuzzing against fwknop:
|
||||
|
||||
$ ./compile/afl-compile.sh
|
||||
$ ./fuzzing-wrappers/spa-pkts.sh
|
||||
|
||||
Fuzzing results will be placed in fuzzing-output/server-conf.out/. For more
|
||||
information, read on.
|
||||
|
||||
## Introduction
|
||||
|
||||
The fwknop project supports various fuzzing strategies, and one of the most
|
||||
important is usage of the 'American Fuzzy Lop' (AFL) fuzzer written by Michal
|
||||
Zalewski (see: [http://lcamtuf.coredump.cx/afl/]). Because AFL is not designed to
|
||||
handle encryption schemes (see the README included in the AFL sources for more
|
||||
information on this), a special --enable-afl-fuzzing command line switch is
|
||||
available in the fwknop autoconf configure script. This argument allows
|
||||
encryption and base64 encoding to be bypassed when feeding SPA packet data to
|
||||
fwknopd via stdin. It is this feature that enables AFL fuzzing. One exception
|
||||
to this is made when using AFL to fuzz the fwknoprc file that is leveraged by
|
||||
the fwknop client - in this case, fwknop should not be compiled with
|
||||
--enable-afl-fuzzing (use the compile/afl-compile-no-enable-arg.sh script).
|
||||
|
||||
The top level directory contains enabling scripts in order to make it easy to
|
||||
fuzz fwknop with AFL. It is assumed that AFL is installed and in your path. The
|
||||
files are in this directory are organized as follows:
|
||||
|
||||
fuzzing-wrappers/ - Directory that contains wrapper scripts for running AFL
|
||||
against fwknop. All interaction with AFL should be done
|
||||
with these scripts, and they should be executed from the
|
||||
test/afl/ directory, e.g. "./fuzzing-wrappers/client-rc.sh"
|
||||
|
||||
test-cases/ - Directory for ALF test cases used by the wrapper scripts.
|
||||
There are four areas in fwknop that are fuzzed: SPA packet
|
||||
encoding/decoding, server access.conf and fwknopd.conf
|
||||
parsing, and client fwknoprc file parsing.
|
||||
|
||||
compile/ - Directory for compilation scripts to ensure fwknop is
|
||||
compiled underneath afl-gcc.
|
||||
|
||||
fuzzing-output/ - Results directory that is made underneath an AFL fuzzing
|
||||
cycle.
|
||||
|
||||
Here is an example of what fwknopd produces when compiled for AFL support when
|
||||
a dummy SPA packet is provided in non-encoded/encrypted form via fwknopd's
|
||||
stdin:
|
||||
|
||||
$ ./fuzzing-wrappers/helpers/fwknopd-stdin-test.sh
|
||||
+ SPA_PKT=1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
+ LD_LIBRARY_PATH=../../lib/.libs ../../server/.libs/fwknopd -c ../conf/default_fwknopd.conf -a ../conf/default_access.conf -A -f -t
|
||||
+ echo -n 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: 'ANY'
|
||||
SPA Field Values:
|
||||
=================
|
||||
Random Value: 1716411011200157
|
||||
Username: root
|
||||
Timestamp: 1397329899
|
||||
FKO Version: 2.0.1
|
||||
Message Type: 1 (Access msg)
|
||||
Message String: 127.0.0.2,tcp/22
|
||||
Nat Access: <NULL>
|
||||
Server Auth: <NULL>
|
||||
Client Timeout: 0
|
||||
Digest Type: 3 (SHA256)
|
||||
HMAC Type: 0 (None)
|
||||
Encryption Type: 1 (Rijndael)
|
||||
Encryption Mode: 2 (CBC)
|
||||
Encoded Data: 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22
|
||||
SPA Data Digest: AAAAA
|
||||
HMAC: <NULL>
|
||||
Final SPA Data: 200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
|
||||
SPA packet decode: Success
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
README.md
|
||||
@@ -0,0 +1,77 @@
|
||||
|
||||
# Fuzzing fwknop With American Fuzzy Lop (AFL)
|
||||
|
||||
## Quick Start
|
||||
|
||||
To get going with AFL fuzzing against fwknop:
|
||||
|
||||
$ ./compile/afl-compile.sh
|
||||
$ ./fuzzing-wrappers/spa-pkts.sh
|
||||
|
||||
Fuzzing results will be placed in fuzzing-output/server-conf.out/. For more
|
||||
information, read on.
|
||||
|
||||
## Introduction
|
||||
|
||||
The fwknop project supports various fuzzing strategies, and one of the most
|
||||
important is usage of the 'American Fuzzy Lop' (AFL) fuzzer written by Michal
|
||||
Zalewski (see: [http://lcamtuf.coredump.cx/afl/]). Because AFL is not designed to
|
||||
handle encryption schemes (see the README included in the AFL sources for more
|
||||
information on this), a special --enable-afl-fuzzing command line switch is
|
||||
available in the fwknop autoconf configure script. This argument allows
|
||||
encryption and base64 encoding to be bypassed when feeding SPA packet data to
|
||||
fwknopd via stdin. It is this feature that enables AFL fuzzing. One exception
|
||||
to this is made when using AFL to fuzz the fwknoprc file that is leveraged by
|
||||
the fwknop client - in this case, fwknop should not be compiled with
|
||||
--enable-afl-fuzzing (use the compile/afl-compile-no-enable-arg.sh script).
|
||||
|
||||
The top level directory contains enabling scripts in order to make it easy to
|
||||
fuzz fwknop with AFL. It is assumed that AFL is installed and in your path. The
|
||||
files are in this directory are organized as follows:
|
||||
|
||||
fuzzing-wrappers/ - Directory that contains wrapper scripts for running AFL
|
||||
against fwknop. All interaction with AFL should be done
|
||||
with these scripts, and they should be executed from the
|
||||
test/afl/ directory, e.g. "./fuzzing-wrappers/client-rc.sh"
|
||||
|
||||
test-cases/ - Directory for ALF test cases used by the wrapper scripts.
|
||||
There are four areas in fwknop that are fuzzed: SPA packet
|
||||
encoding/decoding, server access.conf and fwknopd.conf
|
||||
parsing, and client fwknoprc file parsing.
|
||||
|
||||
compile/ - Directory for compilation scripts to ensure fwknop is
|
||||
compiled underneath afl-gcc.
|
||||
|
||||
fuzzing-output/ - Results directory that is made underneath an AFL fuzzing
|
||||
cycle.
|
||||
|
||||
Here is an example of what fwknopd produces when compiled for AFL support when
|
||||
a dummy SPA packet is provided in non-encoded/encrypted form via fwknopd's
|
||||
stdin:
|
||||
|
||||
$ ./fuzzing-wrappers/helpers/fwknopd-stdin-test.sh
|
||||
+ SPA_PKT=1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
+ LD_LIBRARY_PATH=../../lib/.libs ../../server/.libs/fwknopd -c ../conf/default_fwknopd.conf -a ../conf/default_access.conf -A -f -t
|
||||
+ echo -n 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: 'ANY'
|
||||
SPA Field Values:
|
||||
=================
|
||||
Random Value: 1716411011200157
|
||||
Username: root
|
||||
Timestamp: 1397329899
|
||||
FKO Version: 2.0.1
|
||||
Message Type: 1 (Access msg)
|
||||
Message String: 127.0.0.2,tcp/22
|
||||
Nat Access: <NULL>
|
||||
Server Auth: <NULL>
|
||||
Client Timeout: 0
|
||||
Digest Type: 3 (SHA256)
|
||||
HMAC Type: 0 (None)
|
||||
Encryption Type: 1 (Rijndael)
|
||||
Encryption Mode: 2 (CBC)
|
||||
Encoded Data: 1716411011200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22
|
||||
SPA Data Digest: AAAAA
|
||||
HMAC: <NULL>
|
||||
Final SPA Data: 200157:root:1397329899:2.0.1:1:127.0.0.2,tcp/22:AAAAA
|
||||
|
||||
SPA packet decode: Success
|
||||
Reference in New Issue
Block a user