zzuf is a transparent application input fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data (which more than often comes from untrusted sources on the Internet). It works by intercepting file and network operations and changing random bits in the program’s input. zzuf’s behaviour is deterministic, making it easier to reproduce bugs.
Main zzuf applications are:
- quality assurance: use zzuf to test existing software, or integrate it into your own software’s test suite.
- security: very often, segmentation faults or memory corruption issues mean a potential security hole, zzuf helps exposing some of them
zzuf’s primary target are media players, image viewers and web browsers -(our interest area), because the data they process is inherently insecure, but it was also successfully used to find bugs in system utilities such as “objdump“. The idea of fuzzing input data is barely new, but zzuf’s main purpose is to make things easier and automated.
How to use zzuf?
1. # zzuf hd -vn 32 /dev/zero 2. # zzuf cat /dev/zero | hd -vn 32 3. # zzuf -r 0.001 hd -vn 32 /dev/zero
Sample report using zzuf in debug mode to learn more about what happens, using the -d flag
% zzuf -d file /bin/ls
** zzuf debug ** libzzuf initialised for PID 29526
** zzuf debug ** fopen("/etc/magic", "r") = [3]
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = NULL
** zzuf debug ** fclose([3]) = 0
** zzuf debug ** open("/usr/share/file/magic.mgc", 0) = 3
** zzuf debug ** mmap(NULL, 1636608, 3, 2, 3, 0) = 0x2acce776e000 "x1cx04x1cxf1...
** zzuf debug ** close(3) = 0
** zzuf debug ** fopen("/usr/share/file/magic", "r") = [3]
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
** zzuf debug ** fgets(0x7fffc46e04b0, 8192, [3]) = 0x7fffc46e04b0
We all keep on trying new things and new technology fuzzers are becoming quite handy for finding bugs. zzuf does the same we can pass our custom parameters and check them. Source code of zzuf is also available.
Operating systems supported:
Mostly *nix systems: Linux (glibc), FreeBSD, OpenBSD, Mac OS X and OpenSolaris.
For windows lovers, we need to wait! Work in progress.
Download zzuf version 0.13here
Searches leading to this post:zzuf tutorial, fuzzers tool source code, fuzzing debug linux, usb fuzzer, zzuf pid
You must log in to post a comment.