boofuzz-modbus's Introduction

boofuzz-modbus

modbus fuzzer based on boofuzz framework.!! Cool

Recently i use fuzzer for my papers, modbus fuzzer for boofuzz I only write read_coil_memory packet protocol model.

first version

packet protocol list

In modbus protocol specification.list some type of modbus (after list function_code)

[OK] read_coil(x01)
[OK] read_discrete_inputs(0x02)
read_hoding_registers(0x03)
read_input_register(0x04)
write_single_coil(0x05)
write_single_register(0x06)
read_exception_status(serial line only)(0x07)
diagnostics (Serial Line only)(0x08)
get_comm_event_counter(Serial Line only)(0x0b)
get_comm_event_log(Serial Line only)(0x0c)
write_multiple_coils(0x0f)
write_multiple_registers(0x10)
report_server_id(Serial Line only)(0x11)
read_file_record(0x14)
write_file_record(0x15)
mask_write_register(0x16)
read_write_multiple_registers(0x17)
read_fifo_queue(0x18)
Encapsulated_interface_transport(0x2b) ......

usage

modify target ip address : 127.0.0.1:502

default web ui : http://127.0.0.1:26000

in cmd: python modbus.py

[2018-04-01 06:00:58,785] Test Case: 180
[2018-04-01 06:00:58,785]     Info: primitive name: "modbus_read_coil_memorys", type: Repeat, default value: 
[2018-04-01 06:00:58,785]     Info: Test case 181 of 181 for this node. 180 of 181 overall.
[2018-04-01 06:00:58,785]   Test Step: Fuzzing Node 'modbus_read_coil_memory'
[2018-04-01 06:00:58,786]     Transmitting 212 bytes: 00 00 00 00 00 06 ff 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 b'\x00\x00\x00\x00\x00\x06\xff\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00'

enjoy your fuzzing ! if you have some problem ,contact gmail:[email protected]

boofuzz-modbus's People

Contributors

Stargazers

Watchers

boofuzz-modbus's Issues

BLOCK NAME ALREADY EXISTS error

Ran into a few errors related to an exception raised by SullyRuntimeError. All seem to be referencing duplicate block names. The screen shot shows a sample error output for one of them. Here is the list of blocks need modification before an if statement.
outputsValue line 169
outputsValue line 202
recordData line 263
recordLength line 264
writeQuantityRegisters line 313

boofuzz.sex.SullyRuntimeError: Can't add repeater for non-existent block: read_coil_memory!

When running it, it will throw error for read_coil_memory:

Traceback (most recent call last):
  File "modbus.py", line 333, in <module>
    main()
  File "modbus.py", line 32, in main
    s_repeat("read_coil_memory",min_reps=1,max_reps=255)
  File "/usr/local/lib/python2.7/site-packages/boofuzz/__init__.py", line 274, in s_repeat
    repeat = Repeat(block_name, blocks.CURRENT, min_reps, max_reps, step, variable, fuzzable, name)
  File "/usr/local/lib/python2.7/site-packages/boofuzz/blocks/repeat.py", line 56, in __init__
    "Can't add repeater for non-existent block: %s!" % self.block_name
boofuzz.sex.SullyRuntimeError: Can't add repeater for non-existent block: read_coil_memory!

Running it in python 3 shows another error:

Traceback (most recent call last):
  File "modbus.py", line 333, in <module>
    main()
  File "modbus.py", line 14, in main
    session = Session(
NameError: name 'Session' is not defined

Recommend Projects