Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 07 Mar 2015 16:48:30 +0100
From: Frank Dittrich <>
Subject: Re: Any advice on how to fuzz john jumbo by AFL

On 03/07/2015 03:59 PM, Kai Zhao wrote:
> Would you please show me the Alexander's fuzzing scripts? Thank you.

Openwall's archive stripped the attachments, and gmane doesn't have that
mail at all.
But here is a  version which includes the scripts.

What Alexander's scripts do is:

First, grep the source code for all samples of hashes, and redirect into
a file.

Instead of grepping the source I used
./john --list=format-tests ... | cut -f 3 > ...
(The --list=format-tests option didn't exist when Alexander wrote this

Then, it applied some mangling to (parts of) the hashes (see the
I think I changed the
for $sep ('*', '$')
for $sep ('*', '$', '#')
because some formats use '#' as a separator between components of the hash.

Then, the script tried to process the resulting fuzzed file, for a list
of formats.
Due to the long list of formats and the huge number of fuzzed hashes,
you'll need to either increase the "ulimit -t" values in this script,
or, you'd need to just fuzz the format specific hashes, instead of
testing each format against all the fuzzed hashes.

For all formats that crashed, the script then tries to reduce the test
case until just one hash remains which causes that particular format to

I also ran john against a list of hashes I mangled using zzuf, but I had
much less success than with Alexander's more focused approach.

If you want to look for possibly buggy code, these commands might help
as well:

$ git grep FIXME
$ git grep " XXX"


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.