Fuzzing a network application about winafl HOT 2 OPEN

Hi,

I've never tried to fuzz anything that receives input over network with WinAFL but it might be doable with a few tweaks.

First of all, familiarize yourself with how WinAFL works, see "How does my target run onder WinAFL" in README.

I think the tricky part in this case is getting a new input (generated by WinAFL) in your parsing function for every iteration.

One way to do it would be to create a custom binary that reads a file and feeds it to your parsing function (note: this all needs to be inside the same process). If you can do this you can fuzz it with WinAFL out of the box.

Another approach, in case your target program can handle multiple connection without restarting the process could work like this:

1. WinAFL generates input
2. Your python script reads it, opens a connection to the target and sends the file content
3. WinAFL runs the parsing function and reports the coverage
   In order for this to work you'd need to modify the WinAFL code and remove all the code used to run the target function in a loop (because if your parsing function runs in a loop your target will never accept new connections). Specifically see pre_fuzz_handler and post_fuzz_handler in winafl.c

Another tricky part here would be figuring out when your target is done with one iteration so you can open a new connection. But perhaps your target has some mechanism to keep track of that (e.g. a previous connection got closed)

I'm sure there are other things I'm forgetting but hopefully this is sufficient to get you started.

from winafl.

I also want to do fuzz testing of network application. The first option you mentioned above will not work in my case.
The second approach looks reasonable for me but I don't understand several things:

1. "WinAFL generates input" (ok)
2. Your python script reads it ... Could we just implement this step in WinAFL using raw sockets ?
3. WinAFL runs the parsing function and reports the coverage. In order for this to work you'd need to modify the WinAFL code and remove all the code used to run the target function in a loop (because if your parsing function runs in a loop your target will never accept new connections)... . In my case (and I guess in many other cases) an application handles network data in the following way:

1. Function A listens for the incoming network packets (UDP protocol, ```recvfrom``` function is used).
2. Function A receives network packet.
3. Function A calls function B (parser) and passes network packet as an argument for function B.
4. Function B parses network packet.
5. Function B returns to Function A.
6. Function A listens for the next incoming packet.

I want to do fuzzing of function B and I can run it in the loop. In my case, network input and file input can be considered like the same things (instead of fopen/CreateFile we have recv/recvfrom). Thus, WinAFL probably can work the same way it works now for file-based fuzzing. Am I right or am I missing something important ?

Probably I am wrong at some point. Of course it requires a lot of modifications for WinAFL which is ok with me.

from winafl.