28 July 2010 | 11,443 views

FuzzDiff – Tool For Fuzzing and Crash Analysis

Prevent Network Security Leaks with Acunetix

FuzzDiff is a simple tool to help make crash analysis during file format fuzzing a bit easier. I’m sure many people have written similar tools for their own purposes, but I haven’t seen any that are publicly available. Hopefully at least one person finds it useful.

When provided with a fuzzed file, a corresponding original un-fuzzed file, and the path to the targeted program, FuzzDiff will selectively “un-fuzz” portions of the fuzzed file while re-launching the application to monitor for crashes. This will yield a file that still crashes the target application, but contains a minimum set of changes from the original, un-fuzzed file. This can be useful in pinning down the exact cause of a crash.

The tool is written in Python and currently only works on Unix-based systems, since it monitors for crashes by checking for SIGSEGV. It also assumes that the target program adheres to the syntax “[program] [args] [input file]“. Both of these limitations can be easily worked around. The code is hardly what I’d call production-ready, but it gets the job done.

You can download FuzzDiff here:

fuzzdiff.py

Or read more here.



Recent in Exploits/Vulnerabilities:
- Microsoft Zero Day OLE Vuln Being Exploited In Powerpoint
- Everything You Need To Know About POODLE SSLv3 Vulnerability
- OpenVPN Vulnerable To Shellshock Exploit

Related Posts:
- 4f: The File Format Fuzzing Framework
- Basic Fuzzing Framework (BFF) From CERT – Linux & Mac OSX Fuzzer Tool
- CERT Triage Tools – Vulnerability Impact Assessment Tool

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 227,894 views
- AJAX: Is your application secure enough? - 119,154 views
- eEye Launches 0-Day Exploit Tracker - 85,075 views

Advertise on Darknet

Comments are closed.