Date: Sat, 07 Mar 2015 16:48:30 +0100 From: Frank Dittrich <frank.dittrich@...lbox.org> To: john-dev@...ts.openwall.com Subject: Re: Any advice on how to fuzz john jumbo by AFL On 03/07/2015 03:59 PM, Kai Zhao wrote: > Would you please show me the Alexander's fuzzing scripts? Thank you. Openwall's archive stripped the attachments, and gmane doesn't have that mail at all. But here is a version which includes the scripts. https://marc.info/?l=john-dev&m=136719502025109 What Alexander's scripts do is: First, grep the source code for all samples of hashes, and redirect into a file. Instead of grepping the source I used ./john --list=format-tests ... | cut -f 3 > ... (The --list=format-tests option didn't exist when Alexander wrote this script.) Then, it applied some mangling to (parts of) the hashes (see the fuzz.pl script). I think I changed the for $sep ('*', '$') into for $sep ('*', '$', '#') because some formats use '#' as a separator between components of the hash. Then, the script tried to process the resulting fuzzed file, for a list of formats. Due to the long list of formats and the huge number of fuzzed hashes, you'll need to either increase the "ulimit -t" values in this script, or, you'd need to just fuzz the format specific hashes, instead of testing each format against all the fuzzed hashes. For all formats that crashed, the script then tries to reduce the test case until just one hash remains which causes that particular format to crash. I also ran john against a list of hashes I mangled using zzuf, but I had much less success than with Alexander's more focused approach. If you want to look for possibly buggy code, these commands might help as well: $ git grep FIXME $ git grep " XXX" Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.