Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/ajinabraham/Droid-Application-Fuzz-Framework
Android application fuzzing framework with fuzzers and crash monitor.
https://github.com/ajinabraham/Droid-Application-Fuzz-Framework
android browser corruption crash exploitation fuzzing memory pdf vulnerability
Last synced: about 2 months ago
JSON representation
Android application fuzzing framework with fuzzers and crash monitor.
- Host: GitHub
- URL: https://github.com/ajinabraham/Droid-Application-Fuzz-Framework
- Owner: ajinabraham
- License: gpl-3.0
- Created: 2017-12-21T18:19:36.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2020-10-02T17:02:14.000Z (about 4 years ago)
- Last Synced: 2024-11-07T13:13:30.517Z (about 2 months ago)
- Topics: android, browser, corruption, crash, exploitation, fuzzing, memory, pdf, vulnerability
- Language: HTML
- Homepage: https://opensecurity.in
- Size: 31.7 MB
- Stars: 283
- Watchers: 20
- Forks: 83
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
README
# Droid Application Fuzz Framework
Droid Application Fuzz Framework (DAFF) helps you to fuzz Android Browsers and PDF Readers for memory corruption bugs in real android devices. You can use the inbuilt fuzzers or import fuzz files from your own custom fuzzers. DAFF consist of inbuilt fuzzers and crash monitor. It currently supports fuzzing the following applications:
#### Browsers
* [Google Chrome - com.android.chrome](https://play.google.com/store/apps/details?id=com.android.chrome)
* [Mozilla Firefox - org.mozilla.firefox](https://play.google.com/store/apps/details?id=org.mozilla.firefox)
* [Opera - com.opera.browser](https://play.google.com/store/apps/details?id=com.opera.browser)
* [UC Browser - com.UCMobile.intl](https://play.google.com/store/apps/details?id=com.UCMobile.intl)
#### PDF Viewers/Readers
* [Adobe Acrobat Reader - com.adobe.reader](https://play.google.com/store/apps/details?id=com.adobe.reader)
* [Foxit PDF Reader - com.foxit.mobile.pdf.lite](https://play.google.com/store/apps/details?id=com.foxit.mobile.pdf.lite)
* [Google PDF Viewer - com.google.android.apps.pdfviewer](https://play.google.com/store/apps/details?id=com.google.android.apps.pdfviewer)
* [WPS Office + PDF - cn.wps.moffice_eng](https://play.google.com/store/apps/details?id=cn.wps.moffice_eng)
* [Polaris Office - com.infraware.office.link (WIP)](https://play.google.com/store/apps/details?id=com.infraware.office.link)
### Fuzz Generators
DAFF has three fuzzer modes:
1. **Google Domato** - Uses slightly modified version of [Google Domato](https://github.com/google/domato) for generating fuzz files.
2. **Dumb Fuzzer** - As the the name suggests, a dumb fuzzer. (Only for PDF)
3. **Pregenerated Files (3rd Party Fuzzer)** - To use your private or custom fuzzer generated files. Place html samples in `generators/html/htmls` and pdf samples in `generators/pdf/pdfs`
### Usage for Dummies
#### Android Device
* Install the supported Browsers and PDF readers in Android Device.
* Enable USB Debugging in the Android Device.
* Connect the Android Device to the same WiFi Network where the Computer is connected.
* Connect the Android Device to Computer using USB cable and Always allow the Computer for USB Debuging.
#### Computer
* Install Python 2.7
* `git clone https://github.com/ajinabraham/Droid-Application-Fuzz-Framework.git`
* `pip install -r requirements.txt`
* In `settings.py` set the `DEVICE_ID` as the Android Device ID. You can find this with `adb devices` command.
* Also set `FUZZ_IP` as the local IP of the computer. Use `ifconfig/ipconfig` command.
* Set the path to adb binary in `ADB_BINARY` if `adb` is not in your `PATH`.
* Run the Web GUI `python daff_server.py`
* Access the Fuzzer Web Interface at `http://0.0.0.0:1337`
* Select the Application, Select the Fuzz Generator and Start Fuzzing!
### DAFF in Action
[](https://youtu.be/vHhAj_yZ0kI)
### Extra Tip
After installing the apps in Android Device, use them at least once. Allow popups, configure first time screens etc.
### Please Note
I am just open sourcing a private project for the benefit of community. I don't have time to actively maintain this project. If you have found bugs, fix them and send pull requests. That's how open source should work! I have done my best to make the documentation clear and simple for all types of users. Please check Google or Stack Overflow if you are stuck.