Giter Club home page Giter Club logo

pyjfuzz's Introduction

LOGO

PyJFuzz is a small, extensible and ready-to-use framework used to fuzz JSON inputs, such as mobile endpoint REST API, JSON implementation, Browsers, cli executable and much more.

Version 1.1.0
Homepage http://www.mseclab.com/
Github https://github.com/mseclab/PyJFuzz
Author Daniele Linguaglossa (@dzonerzy)
License MIT - (see LICENSE file)

Installation

Dependencies

In order to work PyJFuzz need some dependency, bottle,netifaces,GitPython and gramfuzz, you can install them from automatic setup.py installation.

Installation

You can install PyJFuzz with the following command

git clone https://github.com/mseclab/PyJFuzz.git && cd PyJFuzz && sudo python setup.py install

Documentation and Examples

CLI tool

Once installed PyJFuzz will create both a python library and a command-line utility called pjf (screenshot below)

MENU

PJF

Library

PyJFuzz could also work as a library, you can import in your project like following

from pyjfuzz.lib import *

Classes

The available object/class are the following:

  • PJFServer - User to start and stop built-in HTTP and HTTPS servers
  • PJFProcessMonitor - Used to monitor process crash, it will automatically restart proccess each time it crash
  • PJFTestcaseServer - The testcase server is used in conjunction with PJFProcessMonitor, whenever a process crash the testcase server will register and store the JSON which cause the crash
  • PJFFactory - It's the main object used to do the real fuzz of JSON objects
  • PJFConfiguration - It's the configuration file for each of the available objects
  • PJFExternalFuzzer - Used by PJFactory is a auxiliary class which provide an interface to other command line fuzzer such as radamsa
  • PJFMutation - Used by PJFFactory provide all the mutation used during fuzzing session
  • PJFExecutor - Provides an interface to interact with external process

CLASSES

Examples

Below some trivial example of how-to implement PyJFuzz powered program

simple_fuzzer.py

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6))
fuzzer = PJFFactory(config)
while True:
    print fuzzer.fuzzed

custom_techniques.py

from argparse import Namespace
from pyjfuzz.lib import *

# Techniques may be defined by group , or by technique number
# groups are CHTPRSX , to understand what they are , please run pyjfuzz with -h switch or look at the command line screenshot
# This below will initalizate a config object which use only the P group attacks where P stay for Path Traversal
config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6, techniques="P"))
# once a config object is defined you can access to config.techniques to view the selected techniques for your group
print("Techniques IDs: {0}".format(str(config.techniques)))
# you can eventually modify them!
config.techniques = [2]
# This way only attack number 2 (LFI Attack) will be performed!
fuzzer = PJFFactory(config)
while True:
    print fuzzer.fuzzed

simple_server.py

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6, debug=True, indent=True))
PJFServer(config).run()

Sometimes you may need to modify standard non customizable settings such as HTTPS or HTTP server port, this can be done in the following way

from argparse import Namespace
from pyjfuzz.lib import *

config = PJFConfiguration(Namespace(json={"test": ["1", 2, True]}, nologo=True, level=6, indent=True))
print config.ports["servers"]["HTTP_PORT"]   # 8080
print config.ports["servers"]["HTTPS_PORT"]  # 8443
print config.ports["servers"]["TCASE_PORT"]  # 8888
config.ports["servers"]["HTTPS_PORT"] = 443  # Change HTTPS port to 443

Remember: When changing default ports, you should always handle exception due to needed privileges!

Below a comprehensive list of all available settings / customization of PJFConfiguration object:

Configuration table

Name Type Description
json dict JSON object to fuzz
json_file str Path to a JSON file
parameters list<str> List of parameters to fuzz (taken from JSON object)
techniques str<int> String of enable attacks, used to generate fuzzed JSON, such as XSS, LFI etc. ie "CHPTRSX" (Look techniques table)
level int Fuzzing level in the range 0-6
utf8 bool If true switch from unicode encode to pure byte representation
indent bool Set whenever to indent the result object
url_encode bool Set whenever to URLEncode the result object
strong_fuzz bool Set whenever to use strong fuzzing (strong fuzzing will not maintain JSON structure, usefull for parser fuzzing)
debug bool Set whenever to enable debug prints
exclude bool Exclude from fuzzing parameters selected by parameters option
notify bool Set whenever to notify process monitor when a crash occurs only used with PJFServer
html str Path to an HTML directory to serve within PJFServer
ext_fuzz bool Set whenever to use binary from "command" as an externale fuzzer
cmd_fuzz bool Set whenever to use binary from "command" as fuzzer target
content_type str Set the content type result of PJFServer (default application/json)
command list<str> Command to execute each paramester is a list element, you could use shlex.split from python

Techniques table

Index Description
0 XSS injection (Polyglot)
1 SQL injection (Polyglot)
2 LFI attack
3 SQL injection polyglot (2)
4 XSS injection (Polyglot) (2)
5 RCE injection (Polyglot)
6 LFI attack (2)
7 Data URI attack
8 LFI and HREF attack
9 Header injection
10 RCE injection (Polyglot) (2)
11 Generic templace injection
12 Flask template injection
13 Random character attack

Screenshots

Below some screenshot just to let you know what you should expect from PyJFuzz

CLI

CLI2

CLI3

Built-in tool

PyJFuzz is shipped with a built-in tool called PyJFuzz Web Fuzzer, this tool will provide an automatic fuzzing console via HTTP and HTTPS server, it can be used to easly fuzz almost any web browser even when you can't control the process state!

There are two switch used to launch this tool (--browser-auto and --fuzz-web), the first one perform automatic browser restart when a crash occur, the other one try to catch when a browser doesn't make requests anymore. Both of them always save the testcases, below some screenshots.

FUZZ

FUZZ2

BROWSERAUTO

BROWSERAUTO2 Issue

Please send any issue here via GitHub I'll provide a fix as soon as possible.

Result

Below a list of know issue found by PyJFuzz, the list will be updated weekly

End

Thanks for using PyJFuzz!

Happy Fuzzing from mseclab

pyjfuzz's People

Contributors

dzonerzy avatar okayming avatar stevenschmatz avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

pyjfuzz's Issues

Disable PJFFactory logger

Hi, I was wondering if it's possible to disable the PJFFactory logger through the PJFConfiguration or in some other way, because for the moment I think there's no control over the creation of it.

Thanks

Fix `long` on mutator

Hey ๐Ÿ‘‹

The long type is not defined in python3.

Can you please fix this line, either by removing it or by adding a long = int in your condition on the top of the file.

Thanks!

(also, you should push your new version to pypi, it's better than to install by commit ๐Ÿ‘)

fuzz broken

It looks like a recent change, commit ec5d82d, fixed fuzzing -p with list, breaks the tool.

Please check Line 158 if len(self.config.parameters) < 0: in pjf_factory.py.

The sample python script like simple_fuzzer.py no longer works as expected.

PJFConfiguration exclude paramters not work

i have a json object,and i want to not fuzz one specificy parameters, such as : a, but the result fuzz the parameter: a. the picture is below
PJFConfiguration: the exclude not work, i want the "a" not fuzz but it fuzz
image
image
image

pip support

Cool project! Please make our life easier for using it and create a PyPi package... https://pypi.python.org/pypi :) This would be very useful, especially when PyJFuzz is used as a lib.

Update pypi package to python 3 support

Hi, just encountered following problem installing PyJFuzz via pypi:

Collecting PyJFuzz
  Using cached https://files.pythonhosted.org/packages/14/19/214133aed1469969c0797bc74335350b061a2e55955e299bf7621aa21904/PyJFuzz-1.1.0.tar.gz
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/private/var/folders/2l/j15h25hx1bn5k9jwms0_ml380000gn/T/pip-build-kltwdnv8/PyJFuzz/setup.py", line 25, in <module>
        import commands
    ModuleNotFoundError: No module named 'commands'

    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /private/var/folders/2l/j15h25hx1bn5k9jwms0_ml380000gn/T/pip-build-kltwdnv8/PyJFuzz/

I assume the package is not up to date with the latest version available on Github, because the manual installation via the repository works just fine with Python 3. The problem only occurs with Python 3.

Meaning fuzzing levels unclear

Hi,

When configurating the the PyJFuzz library for generating messages you can specify a specific fuzzing level 1 to 6. I was not able to find in the documentation what these levels mean exactly and what the difference is when picking another level. Can you make that more clear in the README or something?

Best regards,
Ivar Derksen

JSON order is not maintained

I have provided a sample JSON file with below content and the fuzzed JSON file order is not same as original.

Original: { "data": "Click Here", "vOffset": 100, "alignment": "center" }
Fuzzed: {"vOffset": true, "data": false, "alignment": {"param": "${7*7}a{{cente}}b"}}

Details:
Execution command: C:\Python27\Scripts\pjf.exe --F <filename.json>

I have executed more than 20 times and order is maintained in any run.

how to use pjf fuzz a json parse binary ?

i am learning fuzz. when i try use pjf to fuzz pjf.
[~/fuzz]$ pjf --P "./jq" -p "-r ."
Starting PyJFuzz - Mobile Security Lab 2016


| __ \ | | |
| |) | _ | | | _ _ ________
| / | | | | | | | | | / /
| | | |
| | |
_| | | | |
| |/ / / /
|
| _
, |_
/|| _,//| v1.1.2
/ |
|
/

Author: Daniele 'dzonerzy' Linguaglossa
Mail: [email protected]

[ERROR]: 'bool' object has no attribute 'getitem'.

what happend?

GramFuzzer import error

Hi I am getting following error:

python test.py
Traceback (most recent call last):
File "test.py", line 25, in
from test import test_pjf_factory
File "/root/fuzzer/PyJFuzz/test/test_pjf_factory.py", line 24, in
from pyjfuzz.core.pjf_configuration import PJFConfiguration
File "/root/fuzzer/PyJFuzz/pyjfuzz/core/pjf_configuration.py", line 32, in
from .pjf_grammar import generate_json
File "/root/fuzzer/PyJFuzz/pyjfuzz/core/pjf_grammar.py", line 25, in
from gramfuzz import GramFuzzer
ImportError: cannot import name GramFuzzer

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.