Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 15 Mar 2015 01:24:06 +0300
From: Alexander Cherepanov <>
Subject: Re: Extend AFL to fuzz as you want

On 2015-03-14 17:54, Kai Zhao wrote:
> AFL is good at fuzzing, but it is not very suited to John. The main reason
> is that we can not control
> how to mutate our hash file. In order to control how to mutate hash file, I
> extended AFL in my fork:

AFL is feedback-driven and shouldn't require such extensive guidance. 
Actually, to be like peach fuzzer is exactly what Michal Zalewski tries 
to avoid with AFL. It doesn't mean that your approach is wrong, it's 
just seems strange to combine it with AFL. Perhaps you can use peach 
itself for it?

OTOH the problem is that john is slow and your approach doesn't make it 
run faster. Have you looked why it's slow? Perhaps you can comment some 
other things out? As an extreme example, you can extract (some) valid() 
function and run them standalone (with a minimal wrapper).

> The path is: JohnTheRipper/1.55b, know more about of the changes, please
> see:
> The extension supports xml input file in AFL. I add 'john mode' in AFL, and
> it is especially for john fuzz.
> To use john mode, users must write xml input file which is different from
> currently password file. Here
> is the xml schema:
> The extension is inspired by peach fuzzer pit file. Here is an example of
> the xml file:
> siemens-s7-valid.xml
> ------------------------------------------------------------------------------------
> <?xml version="1.0" encoding="UTF-8"?>
> <AFL case_number="90">    <!-- Totally generates 90 cases -->
>      <DataElement>
>          <string is_mutate="false">$siemens-s7</string>
>                                                              <!--id=1-->
>          <string is_mutate="false">$</string>
>   <!--id=2-->
>          <string is_mutate="false" length="1" type="NUM">1</string>
>                                                       <!--id=3-->
>          <string is_mutate="false">$</string>
>   <!--id=4-->
>          <string length="40"
> type="HEX_STR_L">599fe00cdb61f76cc6e949162f22c95943468acb</string>
> <!--id=5-->
>          <string is_mutate="false">$</string>
>   <!--id=6-->
>          <string length="40"
> type="HEX_STR_L">002e45951f62602b2f5d15df217f49da2f5379cb</string>
>   <!--id=7-->
>      </DataElement>
> </AFL>
> ------------------------------------------------------------------------------------

Thinking about the structure of hashes and trying to express it in an 
abstract form is very useful. E.g., given an exact description of a hash 
a valid() function could be generated automatically.

But XML is not very convenient for a human to work with. I thought about 
something like "$siemens-s7$1$%40h$%40h" or "$siemens-s7$%d$%40h$%40h".

Alexander Cherepanov

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.