Stding fuzzing about manul HOT 8 CLOSED

Hi, thanks for you interest in Manul. There is experimental support for stdin fuzzing. check it out here:

from manul.

Hey is that for stdin or passing commands ?

In other news I tried that but it still wants the @@ and I get an error.

This error only occures when I uncomment cmd_fuzzing = True

Traceback (most recent call last):
File "/usr/lib/python3.7/multiprocessing/process.py", line 297, in _bootstrap
self.run()
File "/usr/lib/python3.7/multiprocessing/process.py", line 99, in run
self._target(*self._args, **self._kwargs)
File "./manul.py", line 993, in run_fuzzer_instance
fuzzer_instance.run() # never return
File "./manul.py", line 851, in run
self.dry_run()
File "./manul.py", line 594, in dry_run
cmd = self.prepare_cmd_to_run(full_input_file_path, False)
File "./manul.py", line 482, in prepare_cmd_to_run
final_string = final_string.replace("@@", target_file_path)
TypeError: replace() argument 2 must be str, not bytearray

The file I'm trying to fuzz is just a little test code to check the fuzzer.

from manul.

Test code as in a simple buffer overflow to test the stdin

from manul.

Well, that's a bug if it doesn't work :)

from manul.

That's why I'm reporting it. I uncommented cmd_fuzzing and this happens. I actually might not be able to do a PR in this case, because I don't know the issue. You could try a str(target_file_path), but what do I know. You programmed this, you're obviously more quilified than me.

from manul.

Am supposed to uncomment it are leave it commented?

from manul.

Do you need help fixing the bug? Can't say I can help much. I know python, but I don't know how you programmed this. I would have to study your codying style. Not to mention study how manul identifies input as a "crash".

from manul.

I'm also keen on using Manul if it can provide stdin like afl does with an afl-like "--" option. In my scenario I have a simple that when run, prompts for a user name and password but that has a deliberate buffer overflow issue. afl finds it when executed like this: afl-fuzz -i in/ -o out/ <binary>

I tried the Manul command line option as the closest fit (i.e. not actually stdin) and got the same crash as @KittyTechnoProgrammer . Python 3.6 on Ubuntu 18.04 LTS using a clean purpose made virtual environment for Manul testing.

from manul.