Getting vulnerable addresses in servers with fuzzing

Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data as inputs to a system to reveal software defects and vulnerabilities. The goal of fuzzing is to identify and exploit weaknesses in the software that could allow attackers to gain unauthorized access, execute malicious code, or cause the system to crash.

Steps in the Fuzzing Process:

1. Target Selection: Choose the software or system to be fuzzed, considering factors like its criticality, potential impact, and attack surface.
2. Fuzzing Tool Selection: Select an appropriate fuzzing tool based on the target system, type of input, and desired level of automation.
3. Fuzzing Input Generation: Generate fuzzing inputs, which can be random, template-based, or mutation-driven, depending on the tool and target.
4. Fuzzing Execution: Execute the fuzzing tool, feeding the generated inputs to the target system and monitoring its behavior.
5. Monitoring and Analysis: Monitor the target system’s response to the fuzzing inputs, looking for crashes, unexpected outputs, or other anomalies.
6. Vulnerability Reporting: Document and report identified vulnerabilities to the software vendor or system administrator for remediation.

Types of Fuzzing:

1. Black-box fuzzing: Treats the target system as a black box, providing random or semi-random inputs without prior knowledge of its internal structure.
2. White-box fuzzing: Utilizes knowledge of the target system’s internal structure and code to generate more targeted and effective fuzzing inputs.
3. Gray-box fuzzing: Combines elements of black-box and white-box fuzzing, leveraging some knowledge of the system’s architecture to guide fuzzing inputs.
4. Mutation-driven fuzzing: Starts with a seed input and repeatedly mutates it, generating new inputs that explore different edge cases and unexpected data combinations.

Benefits of Fuzzing:

1. Uncovering unknown vulnerabilities: Fuzzing can identify vulnerabilities that may have been missed by traditional testing methods.
2. Improving software quality: By exposing weaknesses, fuzzing can lead to more robust and secure software.
3. Proactive vulnerability discovery: Fuzzing can be used proactively to identify vulnerabilities before they are exploited by attackers.
4. Reducing attack surface: By addressing fuzzing-discovered vulnerabilities, the attack surface of the software or system is reduced.

Challenges of Fuzzing:

1. Input generation: Generating effective fuzzing inputs that cover all possible input combinations can be challenging.
2. Resource consumption: Fuzzing can be resource-intensive, requiring significant computational power and time.
3. False positives: Fuzzing may generate inputs that trigger false positives, requiring careful analysis to identify true vulnerabilities.
4. Tool complexity: Some fuzzing tools may have complex configurations and require expertise to use effectively.

Despite these challenges, fuzzing remains a valuable tool for software security testing, helping to uncover vulnerabilities and improve software resilience against cyberattacks.

Web Login with fuzzDB project

This Python script checks a list of login resources on a target domain using the requests library.

1. Importing Required Modules:

import requests

The script imports the requests module for making HTTP requests.

2. Reading Login Resources from File:

logins = []

# Open file and read the content into a list
with open('Logins.txt', 'r') as filehandle:
    for line in filehandle:
        login = line.strip()
        logins.append(login)

The script reads a list of login resources from a file named ‘Logins.txt’ and stores them in the logins list.

3. Target Domain:

domain = "http://testphp.vulnweb.com"

The target domain is set to “http://testphp.vulnweb.com” for demonstration purposes. Change this to the actual target domain.

4. Checking Login Resources:

for login in logins:
    print("Checking... " + domain + login)
    response = requests.get(domain + login)
    if response.status_code == 200:
        print("Login resource detected: " + login)

The script iterates through each login resource in the logins list, sends a GET request to the target domain with the login resource appended, and checks if the HTTP response status code is 200. If a 200 status code is received, it prints that a login resource is detected.

Summary:

• The script checks a list of login resources on a target domain using the requests library.
• It reads the login resources from a file (‘Logins.txt’) and sends GET requests to the target domain with each login resource appended.
• If a 200 status code is received, it indicates that a login resource is detected.

import requests

logins = []

# open file and read the content in a list
with open('Logins.txt', 'r') as filehandle:
    for line in filehandle:
        login = line[:-1]
        logins.append(login)

domain = "http://testphp.vulnweb.com"

for login in logins:
	print("Checking... "+ domain + login)
	response = requests.get(domain + login)
	if response.status_code == 200:
		print("Login resource detected: " +login)

Note:

• Ensure the ‘requests’ library is installed before running the script (pip install requests).
• Modify the domain variable to the actual target domain.
• Adjust the file name and format if the list of login resources is stored differently.

Detecting SQL Injection with fuzzDB project

This Python script detects MySQL injection vulnerabilities by sending SQL injection payloads to a target URL and checking for specific responses.

1. Importing Required Modules:

import requests

The script imports the requests module for making HTTP requests.

2. Target URL and Payloads:

domain = "http://testphp.vulnweb.com/listproducts.php?cat="

The target URL is set to “http://testphp.vulnweb.com/listproducts.php?cat=” for demonstration purposes. Change this to the actual target URL.

mysql_attacks = []

# Open file and read the content into a list
with open('MSSQL.txt', 'r') as filehandle:
    for line in filehandle:
        attack = line.strip()
        mysql_attacks.append(attack)

The script reads a list of SQL injection payloads from a file named ‘MSSQL.txt’ and stores them in the mysql_attacks list.

3. Checking for MySQL Injection:

for attack in mysql_attacks:
    print("Testing... " + domain + attack)
    response = requests.get(domain + attack)
    if "mysql" in response.text.lower():
        print("Injectable MySQL detected")
        print("Attack string: " + attack)

The script iterates through each SQL injection payload in the mysql_attacks list, sends a GET request to the target URL with the payload appended, and checks if the response contains the string “mysql” in a case-insensitive manner. If the string is detected, it prints that an injectable MySQL vulnerability is detected.

Summary:

• The script checks for MySQL injection vulnerabilities by sending SQL injection payloads to a target URL and checking for specific responses.
• It reads the SQL injection payloads from a file (‘MSSQL.txt’) and sends GET requests to the target URL with each payload appended.
• If the response contains the string “mysql” (case-insensitive), it indicates an injectable MySQL vulnerability.

import requests

domain = "http://testphp.vulnweb.com/listproducts.php?cat="

mysql_attacks = []

# open file and read the content in a list
with open('MSSQL.txt', 'r') as filehandle:
    for line in filehandle:
        attack = line[:-1]
        mysql_attacks.append(attack)

for attack in mysql_attacks:
	print("Testing... "+ domain + attack)
	response = requests.get(domain + attack)
	if "mysql" in response.text.lower(): 
		print("Injectable MySQL detected")
		print("Attack string: "+attack)

Note:

• Modify the domain variable to the actual target URL.
• Adjust the file name and format if the list of SQL injection payloads is stored differently.
• Be cautious when testing on live systems and ensure you have appropriate authorization to perform security testing.