Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 6 Jun 2015 10:58:58 +0300
From: Solar Designer <>
Subject: Re: poor man's fuzzer

On Fri, Jun 05, 2015 at 08:13:28PM +0200, Frank Dittrich wrote:
> Alexander Cherepanov also posted a john format fuzzer some time ago
> which uncovered tons of bugs:

Yes, I knew that.  I didn't recall that he also had a script called, though.  I would have named mine differently then.

> It needs some adjustments:
> -it is not longer necessary to search the source code for hashes, this
> can be replaced with ./john --list=format-tests | cut -f 3

This is already implemented in my

> -some hashes use additional delimiters between components of hashes,
> e.g., '#' instead of just '$' and '*'.

Good point!  We need to add more overstrike characters to my
Right now, it uses '9' and '$'.

> and may be
> -don't run each format against all the fuzzed format tests of all
> formats (at least not as long as you find bugs by just fuzzing the
> format specific hashes

This is also already implemented in my  It keeps track of not
only test vectors, but also the corresponding format names.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.