[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 07 Mar 2015 16:48:30 +0100
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-dev@...ts.openwall.com
Subject: Re: Any advice on how to fuzz john jumbo by AFL
On 03/07/2015 03:59 PM, Kai Zhao wrote:
> Would you please show me the Alexander's fuzzing scripts? Thank you.
Openwall's archive stripped the attachments, and gmane doesn't have that
mail at all.
But here is a version which includes the scripts.
https://marc.info/?l=john-dev&m=136719502025109
What Alexander's scripts do is:
First, grep the source code for all samples of hashes, and redirect into
a file.
Instead of grepping the source I used
./john --list=format-tests ... | cut -f 3 > ...
(The --list=format-tests option didn't exist when Alexander wrote this
script.)
Then, it applied some mangling to (parts of) the hashes (see the fuzz.pl
script).
I think I changed the
for $sep ('*', '$')
into
for $sep ('*', '$', '#')
because some formats use '#' as a separator between components of the hash.
Then, the script tried to process the resulting fuzzed file, for a list
of formats.
Due to the long list of formats and the huge number of fuzzed hashes,
you'll need to either increase the "ulimit -t" values in this script,
or, you'd need to just fuzz the format specific hashes, instead of
testing each format against all the fuzzed hashes.
For all formats that crashed, the script then tries to reduce the test
case until just one hash remains which causes that particular format to
crash.
I also ran john against a list of hashes I mangled using zzuf, but I had
much less success than with Alexander's more focused approach.
If you want to look for possibly buggy code, these commands might help
as well:
$ git grep FIXME
$ git grep " XXX"
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
