Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/htrgouvea/fuzzpm
Differential Fuzzer to hunt for logic bugs on Perl Modules
https://github.com/htrgouvea/fuzzpm
differential differential-fuzzing fuzzing
Last synced: about 1 month ago
JSON representation
Differential Fuzzer to hunt for logic bugs on Perl Modules
- Host: GitHub
- URL: https://github.com/htrgouvea/fuzzpm
- Owner: htrgouvea
- License: other
- Created: 2021-10-07T23:38:36.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2024-06-26T19:52:11.000Z (6 months ago)
- Last Synced: 2024-06-27T00:15:17.329Z (6 months ago)
- Topics: differential, differential-fuzzing, fuzzing
- Language: Perl
- Homepage: https://heitorgouvea.me/2021/12/08/Differential-Fuzzing-Perl-Libs
- Size: 138 KB
- Stars: 23
- Watchers: 2
- Forks: 5
- Open Issues: 6
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE.md
- Security: SECURITY.md
Awesome Lists containing this project
README
FuzzPM
Differential Fuzzing for Perl Modules
---
### Summary
This project aims to demonstrate how we can use the differential fuzzing technique to conduct security analysis in an automated and large-scale way to find security issues in modern components used by applications developed in Perl. Full publication is avaible on: [https://heitorgouvea.me/2021/12/08/Differential-Fuzzing-Perl-Libs](https://heitorgouvea.me/2021/12/08/Differential-Fuzzing-Perl-Libs).
---
### Download and install
```bash
# Download
$ git clone https://github.com/htrgouvea/fuzzpm && cd fuzzpm
# Install libs and dependencies
$ cpanm --installdeps .
```
---
### How it works
Differential fuzzing is an approach where we have our seeds being sent to two or more inputs, where they are consumed and should produce the same output. At the end of the test these outputs are compared, in case of divergence the fuzzer will signal a possible failure [[1]].(https://en.wikipedia.org/wiki/Differential_testing)
So basically we have 3 components:
- Our targets;
- Input seeds;
- Test cases;
Here is a introduction about how you can create your own targets, seeds and test cases.
To create your entire fuzzing case, you first need to create your target library as a package, for example:
```perl
package Mojo_URI {
use strict;
use warnings;
use Try::Tiny;
use Mojo::URL;
sub new {
my ($self, $payload) = @_;
try {
my $url = Mojo::URL -> new($payload);
return $url -> host;
}
catch {
return undef;
}
}
}
```
Store at: ./targets/your-taget-name.pm.
So, you need store your seeds as a file at: ./seeds/your-seeds.txt. And the last part is your case as a YAML file, follow this structure:
```yaml
test:
seeds:
- path/to/seeds-file.txt
libs:
- First_Target
- Second_Target
- Third_Target
```
For example, for our first case, the following YAML file was constructed and is supplied to the fuzzer via the parameter “--case”:
```yaml
test:
seeds:
- seeds/urls-radamsa.txt
libs:
- Mojo_URI
- Tiny_HTTP
- Mojo_UA
- Mechanize
- Lib_Furl
- Simple_URI
```
---
### Fuzzing
```bash
$ perl fuzzpm.pl --case cases/json-decode.yml
$ perl fuzzpm.pl --case cases/parsing-url.yml
```
---
### Docker container
```
$ docker build -t fuzzpm .
$ docker run -ti --rm fuzzpm --help
```
---
### Contribution
Your contributions and suggestions are heartily ♥ welcome. [See here the contribution guidelines.](/.github/CONTRIBUTING.md) Please, report bugs via [issues page](https://github.com/htrgouvea/fuzzpm/issues) and for security issues, see here the [security policy.](/SECURITY.md) (✿ ◕‿◕)
---
### License
This work is licensed under [MIT License.](/LICENSE.md)