24 Sep, 2008 in
OWASP AppSec NYC 2008 by
Josh
Web Admin Blog
Real Web Admins. Real World Experience.Latest
The 1.0 release of Google Chrome has everyone abuzz. Here at NI, loads of people are adopting it. Shortly after it went gold, we started to hear from users that they were having problems with our internal collaboration solution, based on the Atlassian Confluence wiki product. They'd hit a page and get a terse error, which[...]
READ FULL ARTICLE »
This presentation was by Yiannis Pavlosoglou who is the developer on the OWASP fuzzing project.
Address the challenges of fuzzing, during applicaton layer penetration tests and security assessments. Designed for fuzzing web applications. Open-source and free. Written in Java. Scriptable.
Fuzzer Workflow
- Select fuzzers
- Send requests
- Collect responses
- Compare results
Building a fuzzer entails a stable, ease to use interface, a solid fuzzing engine, and unconventional protocol APIs.
Likely Problems:
- How do you group payloads?
- How do you customize/iterate through permutations?
- Cannot use Apache HTTP Commons
- Cannot use Java HTTP/S Libraries
Addressing Problems:
- Graphical User Interface
- Write requests/responses to a file
- Payloads read from file
- Payloads grouped into fuzzers
- Fuzzers grouped into categories
- Use TCP Sockets for fuzzing
- Implement POST “Content-Length”
- Support SSL sockets for fuzzing
- Support HTTP/1.1 chunked encoding
47 classes spread into 13 packages. 13,123 lines of java code. Do one thing and do it well! Tell the user what you are putting on the wire. Don’t obey HTTP/S. Trust the JBroFuzz Core to generate payloads.
Roadmap
- MSI Installer
- Basic NTLM Authentication
- Proxy Requests
- Graphing Tab
E-mail yiannis@owasp.org with questions.
Anonymous | October 24th, 2008 at 1:01 pm #
IMHO Powerfuzzer (powerfuzzer.sourceforge.net) is much simpler to use and effective.