[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 15 Mar 2015 01:24:06 +0300
From: Alexander Cherepanov <ch3root@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: Extend AFL to fuzz as you want
On 2015-03-14 17:54, Kai Zhao wrote:
> AFL is good at fuzzing, but it is not very suited to John. The main reason
> is that we can not control
> how to mutate our hash file. In order to control how to mutate hash file, I
> extended AFL in my fork:
AFL is feedback-driven and shouldn't require such extensive guidance.
Actually, to be like peach fuzzer is exactly what Michal Zalewski tries
to avoid with AFL. It doesn't mean that your approach is wrong, it's
just seems strange to combine it with AFL. Perhaps you can use peach
itself for it?
OTOH the problem is that john is slow and your approach doesn't make it
run faster. Have you looked why it's slow? Perhaps you can comment some
other things out? As an extreme example, you can extract (some) valid()
function and run them standalone (with a minimal wrapper).
> https://github.com/loverszhaokai/JohnTheRipper/tree/add_afl
>
> The path is: JohnTheRipper/1.55b, know more about of the changes, please
> see:
>
> https://github.com/loverszhaokai/JohnTheRipper/blob/add_afl/afl-1.55b/readme.markdown
>
> The extension supports xml input file in AFL. I add 'john mode' in AFL, and
> it is especially for john fuzz.
> To use john mode, users must write xml input file which is different from
> currently password file. Here
> is the xml schema:
>
> https://github.com/loverszhaokai/JohnTheRipper/blob/add_afl/afl-1.55b/docs/john.markdown#xml-schema
>
> The extension is inspired by peach fuzzer pit file. Here is an example of
> the xml file:
>
> siemens-s7-valid.xml
> ------------------------------------------------------------------------------------
> <?xml version="1.0" encoding="UTF-8"?>
>
> <AFL case_number="90"> <!-- Totally generates 90 cases -->
> <DataElement>
> <string is_mutate="false">$siemens-s7</string>
> <!--id=1-->
> <string is_mutate="false">$</string>
>
> <!--id=2-->
> <string is_mutate="false" length="1" type="NUM">1</string>
> <!--id=3-->
> <string is_mutate="false">$</string>
>
> <!--id=4-->
> <string length="40"
> type="HEX_STR_L">599fe00cdb61f76cc6e949162f22c95943468acb</string>
> <!--id=5-->
> <string is_mutate="false">$</string>
>
> <!--id=6-->
> <string length="40"
> type="HEX_STR_L">002e45951f62602b2f5d15df217f49da2f5379cb</string>
> <!--id=7-->
> </DataElement>
> </AFL>
> ------------------------------------------------------------------------------------
Thinking about the structure of hashes and trying to express it in an
abstract form is very useful. E.g., given an exact description of a hash
a valid() function could be generated automatically.
But XML is not very convenient for a human to work with. I thought about
something like "$siemens-s7$1$%40h$%40h" or "$siemens-s7$%d$%40h$%40h".
--
Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
