Finding Bugs FASTER with Fuzzing

Fuzzing:
Finding Bugs FASTER
Alper Basaran
basaranalper@gmail.com
Alper Basaran - basaranalper@gmail.com

• Alper Basaran
• Founder of Sparta Bilisim
• 15+ years as penetration tester
• Published author
‫ֶם‬‫כ‬‫י‬ֵ‫ֲל‬‫ע‬ ‫לֹום‬ ָׁ‫ש‬

Today
• We’ll see where fuzzing fits
• We’ll discuss fuzzing approaches
• We’ll try to find zero-days*
• Hotel booking application
• Rentacar application
• Students Test Results System

Fuzzing...
«(...)There is no teacher but the enemy. No one but the enemy will tell
you what the enemy is going to do. No one but the enemy will ever
teach you how to destroy and conquer. Only the enemy shows you
where you are weak.»
- Ender’s Game

Fuzzing...
«πόλλ' οἶδ' ἀλώπηξ, ἀλλ' ἐχῖνος ἓν μέγα»
- Archilochus

Fuzzing...
«a fox knows many things, but a hedgehog one
important thing»
- Archilochus

Fuzzing is NOT new..
• «We didn't call it fuzzing back in the 1950s, but it was our
standard practice to test programs by inputting decks of punch
cards taken from the trash. We also used decks of random
number punch cards. We weren't networked in those days, so
we weren't much worried about security, but our random/trash
decks often turned up undesirable behavior. Every programmer
I knew (and there weren't many of us back then, so I knew a
great proportion of them) used the trash-deck technique.»
- Gerald M. Weinberg

Fuzzing in a Nutshell
Fuzzer Application
• SQLi
• XSS
• RCE
• Directory traversal
• Errors
• Crashes
• No response

Fuzzing in a Nutshell (Corrected)
Fuzzer Application
• SQLi
• XSS
• RCE
• Errors
• Crashes
• No response
• Different response

Fuzzing in a Nutshell (Corrected)
Fuzzer Application
• SQLi
• XSS
• RCE
• Errors
• Crashes
• No response
• Different response
Monitor These

Fuzzing Data
• Mutation-based: Mutate existing data
• Tested URL: http://example.com/test?id=user
• Mutation: http://example.com/test?id=user2 ?
• Mutation: http://example.com/test?id=admin ?
• Generated: Generate/use other data
• Tested URL: http://example.com/test?id=user
• Mutation: http://example.com/test?id=1 ?
• Mutation: http://example.com/test?id=../../../../../../etc/passwd ?

Penetration Testing (Reminder)
• Trying to find vulnerabilities
• Types of penetration testing
• White box
• Black box
• Grey box
• Where’s «penetration testing» located?
• Usually at the end ☺
• At the end of what?

Software Development Lifecycle
• Ideally:
Source: http://download.microsoft.com/download/B/8/2/B8282D75-433C-4B7E-B0A0-FFA413E20060/microsoft_security_development_lifecycle.pdf

In Reality
From: ITguy@customerisright.com
To: alper@sparta.com.tr
Subject: URGENT!!!!!
I’ve just been told that our Marketing department is
launching a promotional website tomorrow!!
Could you please quickly do a pentest.
K thanx, bye

Software Development Lifecycle
• In real life:
Source: http://download.microsoft.com/download/B/8/2/B8282D75-433C-4B7E-B0A0-FFA413E20060/microsoft_security_development_lifecycle.pdf
Tests
About there:

Penetration Testing

Penetration Testing (Limitations)
• Time, time and time
• Resources
• Job probably goes to the lowest offer
• Time?

Source Code Review
• Will require access to source code
• How does it work?

Source Code Review
https://www.geeksforgeeks.org/buffer-overflow-attack-with-example/Alper Basaran - basaranalper@gmail.com

Source Code Review
• https://owasp.org/www-community/Source_Code_Analysis_Tools

Source Code Review
https://dwheeler.com/flawfinder/
• apt install python-pip
• pip install flawfinder

Source Code Review (Limitations)
• How does it work?
• cat, grep, awk...
• What about third party libraries/modules?
• What about comments?
• Can ONLY find POTENTIAL vulnerabilities

So What Happens when?
• Testing time is limited
• You don’t have access to the source code
«Start fuzzing»
WE FUZZ!

Why do we Fuzz?
• We try to find inputs that lead to errors or insecurities
• It’s not an «elegant» technique
• Used for:
• Quality assurance
• Vulnerability assessment

Fuzzing (limitations)
• Doesn’t understand the logic of the application
• Normally you get a 404
• 404 (from user accessible page)
• 404 (from admin accessible page)
Fuzzer will most likely miss this

• Doesn’t understand the logic of the application
• Looking for a buffer overflow
• no crash
• no crash
• no crash
• no crash
• no crash
• no crash (login successful)
• no crash
• no crash
• no crash
• Crash
Fuzzer will most likely miss this

• You’ll have to investigate exploitability
• Fuzzing live systems can be «dangerous»
• You’ll miss complex vulnerabilities

Why do we fuzz? (Software bugs/tests)
• Quality testers fuzz to make sure
• Everything works
• App doesn’t crash
• App can handle number of requests
Source: https://stackoverflow.com/questions/16521143/fuzz-test-framework-web-applicationAlper Basaran - basaranalper@gmail.com

Why do we fuzz? (Software vulnerabilities)
• Types of vulnerabilities:
• Design errors: Authentication by-pass
• Execution errors: Buffer Overflows
• Installation errors: Configuration flaws
• We fuzz mainly to;
• Uncover anything that can impact CIA
• Map attack surface
• Locate trust boundaries
• Find «hostile» data
Source: f5.com

Hostile Data
• Mostly characters but also any data that can make the app do
something it shouldn’t
• Special characters would mainly be:
~ $ * _ } / '
! % ( + ] ` ? "
@ ^ ) = [ , ; <
# & _ { | . : >

Hostile Data
• Special characters would mainly be:
~ $ * _ } / '
! % ( + ] ` ? "
@ ^ ) = [ , ; <
# & _ { | . : >
Breaks SQL
Adds Command
Comments

Hostile Data
• Special characters
• File types
• File metadata
• Headers
• ...

How do we fuzz?
Fuzzer Target
Request 1
Expected response (e.g. 404)
Request 2
Unexpected response (e.g. 503)
Request n
Unexpected response (No response)

How do we fuzz?
• Fuzzing phases:
1. Identify targets
2. Identify inputs
3. Generate data
4. Execute
5. Monitor anomalies
6. Check exploitability
1 - Identify targets
2 - Identify inputs
3 - Generate data
4 - Execute
5 - Monitor anomalies
6 - Check exploitability

How do we fuzz?
• Fuzzing phases: 1 - Identify targets
• Parameters (GET and POST)
• Google
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 1 - Identify targets
• Google Hacking
• https://www.exploit-db.com/google-hacking-database
• GH is interested in results, we look for inputs
• E.g. php?id=
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 2 - Identify inputs
• What is the app «normally» expecting
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 3 - Generate data
• Fuzzing payloads
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 4 - Execute
• Fuzz ☺
• Fuzz 
• Fuzz ...
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 5 - Monitor anomalies
• What would the «normal» response be?
• Is there anything different in the response?
• HTTP code?
• Response size?
• Error?
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing phases: 6 - Check exploitability
• So?
• How can we exploit this?
2 - Identify inputs
3 - Generate data
4 - Execute

How do we fuzz?
• Fuzzing web applications:
1. Find data entry points
• Anything sent from the client
2. Generate payload list
• Long
• Odd characters (encoded)
• Special characters (new line character, line feed, etc.)
3. Fuzz
4. Detect anomalies
5. Check exploitation

What do we fuzz?
• Short answer: Everything!
• GET data
• POST data
• User agent
• Cookies
• File metadata
• etc...

What do we fuzz?
• GET
• Host
• User-Agent
• Accept
• Accept-Language
• Accept-Encoding
• Connection
• Cookie
• Upgrade-Insecure-Requests

A Few Reminders

HTTP Requests
Request
Response

Special Characters in URLs
• #: Anchor (or %23)
• ?: Query string (or %3F)
• &: Seperating query elements (or %26)
• +: Space (or %2B)
• https://www.w3schools.com/tags/ref_urlencode.asp

HTTP Methods
• HTTP works as a communication protocol between clients and servers
• HTTP methods defines the type of the request made by the client
• You’ll mostly see;
• GET
• POST

HTTP Methods
• You might also see:
• GET
• POST
• PUT
• HEAD
• DELETE
• PATCH
• OPTIONS

HTTP Methods
• But we are fuzzers!
• so;
ACL GET MKCOL PRI UNBIND
BASELINE-CONTROL HEAD MKREDIRECTREF PROPFIND UNCHECKOUT
BIND LABEL MKWORKSPACE PROPPATCH UNLINK
CHECKIN LINK MOVE PUT UNLOCK
CHECKOUT LOCK OPTIONS REBIND UPDATE
CONNECT MERGE ORDERPATCH REPORT UPDATEREDIRECTREF
COPY MKACTIVITY PATCH SEARCH VERSION-CONTROL
DELETE MKCALENDAR POST TRACE

HTTP Response Codes
• 1xx informational response: The request was received, continuing
process
• 2xx successful: The request was successfully received, understood,
and accepted
• 3xx redirection: Further action needs to be taken in order to complete
the request
• 4xx client error: The request contains bad syntax or cannot be fulfilled
• 5xx server error: The server failed to fulfil an apparently valid request

Input / Output Validation
• Application should distinguish between a valid input and a malformed
input
• Application should NOT trust the user
• Input fields are not the only way to send data to the server
• Anything on the HTTP connection can be an input

Input / Output Validation
• Two main approaches:
• Blacklist:
• Don’t accept these:
• <script>
• ‘ or ‘1’=‘1
• Whitelist:
• Only accept these
• [a-z]
• [0-9]
Client
Side
Server
Side
Input
Validation

Tools: HTTP Headers Live

Tools: Cookie Quick Manager

Tools: Burp Suite

Tools: Burp Suite
• Sniper: Uses a single set of payloads.
• Battering ram: Uses a single set of payloads. It iterates through the
payloads and places the same payload into all of the defined payload
positions at once.
• Pitchfork: Uses multiple payload sets. There is a different payload set for
each defined position (up to a maximum of 20). The attack iterates through
all payload sets simultaneously, and places one payload into each defined
position.
• Cluster bomb: Uses multiple payload sets. There is a different payload set
for each defined position (up to a maximum of 20). The attack iterates
through each payload set in turn, so that all permutations of payload
combinations are tested.

Tools: Burp Suite
source: http://www.iana.org/assignments/http-methods/http-methods.xhtmlAlper Basaran - basaranalper@gmail.com

• Method: ACL
• Response: 501 (Not Implemented)
• Server: AkamaiGHost
Tools: Burp Suite

• Method: BIND
• Response: 400 (Bad Request)
• Server: AkamaiGHost
Tools: Burp Suite

• Method: OPTIONS
• Response: 500 (Internal Server Error)
• Server: istio-envoy
Tools: Burp Suite

So?
• Can you use this to «crash» the server?
• Can you use this to enumerate further?

Tools: Wfuzz

Tools: Wfuzz
• Basic usage:
• wfuzz –w wordlist http://www.target.com/FUZZ

Tools: Wfuzz
• wfuzz -w wordlist.txt https://www.apple.com/FUZZ
• We can add:
• --hc: To hide specific response
• -f: to save results to a file

Tools: Wfuzz
-v

Tools: Wfuzz
--follow

Tools: Wfuzz
• Let’s login
• Tools we’ll need:
• Cewl
• Wfuzz

Tools: Wfuzz
• Cewl will parse the target page and generate a wordlist

Tools: Wfuzz
• We’ll use the wordlist generated by Cewl to bruteforce login
• and a Wfuzz payload

Tools: Wfuzz
• wfuzz -c -z file,wordlist.txt -d "username=admin&password=FUZZ&Login=Login" -
v http://192.168.19.140/dvwa/login.php
• -c: Color
• -z:
• -d:
• -v: verbose

Tools: Wfuzz
• wfuzz -c -z file,wordlist.txt -d "username=admin&password=FUZZ&Login=Login"
http://192.168.19.140/dvwa/login.php
• -c: Color
• -z: Payload
• -d: Data sent in POST
• So? Could we login?

Tools: Wfuzz
• wfuzz -c -z file,wordlist.txt -d "username=admin&password=FUZZ&Login=Login"
http://192.168.19.140/dvwa/login.php
• -c: Color
• -z: Payload
• -d: Data sent in POST
• So? Could we login?
• Add -v (verbose)

Tools: Wfuzz
--verbose

Tools: Wfuzz
• Directory enumeration
--hc 404

Tools: Wfuzz
• SQL injection login bypass

Tools: Wfuzz
• wfuzz -w /usr/share/wordlists/wfuzz/Injections/SQL.txt -d
"uid=FUZZ&passw=FUZZ&btnSubmit=Login" -v http://www.altoromutual.com:8080/doLogin

Tools: Wfuzz
• wfuzz -w /usr/share/wordlists/wfuzz/Injections/SQL.txt -b="security=low;
PHPSESSID=c8e5524009676cedd43acbfdde12ea52"
http://192.168.19.140/dvwa/vulnerabilities/sqli/?id=FUZZ&Submit=Submit#
• -w /usr/share/wordlists/wfuzz/Injections/SQL.txt
• -b="security=low; PHPSESSID=c8e5524009676cedd43acbfdde12ea52"

Tools: OWASP ZAP

Fuzzing methods
• Fuzzing payloads
• Pregenerated
• Random

3. Fuzzing approaches
a) Test case-based fuzzing
b) Random fuzzing
c) Using existing fuzzing payloads
d) Generating a specific payload list

3. Fuzzing approaches
a) Test case-based fuzzing
b) Random fuzzing
c) Using existing fuzzing payloads
d) Generating a specific payload list
Smart: «Thinking about what to send»
Dumb: «Send everything but the kitchen sink»

Case Based Fuzzing
• Understanding «what can be» and fuzzing accordingly

Fuzzing: OWASP Top 10 2020
1. SQL injection
2. Broken Authentication.
3. Sensitive Data Exposure.
4. XML External Entities (XXE).
5. Broken Access Control.
6. Security Misconfiguration
7. Cross-Site Scripting XSS.
8. Insecure Deserialization.
9. Using Components with Known Vulnerabilities.
10. Insufficient Logging & Monitoring.

Case Based Fuzzing
1. SQL injection:
a) A web application connected to a database
b) An input sending a query to the database
c) A visible (or invisible) output

Case Based Fuzzing
2. Broken Authentication.
a) Permits automated attacks such as credential stuffing
b) Permits brute force or other automated attacks.
c) Permits weak passwords, such as”Password1″ or “admin/admin.″
d) Uses weak or ineffective credential recovery and forgot-password processes (e.g.
what is your date of birth).
e) Uses plain text, encrypted, or weakly hashed passwords.
f) Has missing or ineffective multi-factor authentication.
g) Exposes session IDs in the URL (e.g., URL rewriting).
h) Does not rotate session IDs after successful login.
i) Does not properly invalidate session IDs. User sessions or authentication tokens
(particularly single sign-on (SSO) tokens) aren’t properly invalidated during logout
or a period of inactivity.
Source: https://sucuri.net/guides/owasp-top-10-security-vulnerabilities-2020/

Case Based Fuzzing
3. Sensitive Data Exposure
• Via stored or transmitted data
a) Credentials
b) Credit card numbers
c) Social Security Numbers
d) Medical information
e) Personally identifiable information (PII)
f) Other personal information

Case Based Fuzzing
4. XML External Entities (XXE).
• Via stored or transmitted data
a) Vulnerable XML processors if malicious actors can upload XML or include
hostile content in an XML document
b) Vulnerable code
c) Vulnerable dependencies
d) Vulnerable integrations

Case Based Fuzzing
5. Broken Access Control
• e.g. access admin login page
a) Access to a hosting control / administrative panel
b) Access to a server via FTP / SFTP / SSH
c) Access to a website’s administrative panel
d) Access to other applications on your server
e) Access to a database

Case Based Fuzzing
6. Security Misconfiguration
• e.g. default CMS configuration
a) Unpatched flaws
b) Default configurations
c) Unused pages
d) Unprotected files and directories
e) Unnecessary services

Case Based Fuzzing
7. Cross-Site Scripting XSS
• Most common vulnerability?
a) Must take input
b) Must include input in response source code
c) Also must have login/session

Case Based Fuzzing
8. Insecure Deserialization
• Convert object to byte strings: serialization
• Convert byte strings to objects: deserialization
• Cookie contains BASE64 encoded of «user:Alice,privilege:user»
(dXNlcjpBbGljZSxwcml2aWxlZ2U6dXNlcg==)
• Can it be changed to «user:Alice,privilege:admin»
(dXNlcjpBbGljZSxwcml2aWxlZ2U6YWRtaW4=)
a) Deserialize an object
b) Modify the object
c) Serialize it again

Case Based Fuzzing
9. Using Components with Known Vulnerabilities

Random Fuzzing
• «Everything but the kitchen sink»

Random Fuzzing
• Wfuzz wordlists

Random Fuzzing
• https://github.com/danielmiessler/SecLists/tree/master/Fuzzing

Random Fuzzing
• https://github.com/chrislockard/api_wordlist

Generating a Wordlist
• Cewl
• Crunch 4 4 1234
• crunch 9 9 -t @@@@1107!
• @ letter
• , capital letter
• % number
• ^ special char
• wget, cat, grep, cut, sort ☺

Questions?
basaranalper@gmail.com

Finding Bugs FASTER with Fuzzing

More Related Content

Similar to Finding Bugs FASTER with Fuzzing

More from Alper Başaran

Finding Bugs FASTER with Fuzzing