Dharma – Generation-based Context-free Grammar Fuzzing Tool

Your website & network are Hackable


Dharma is a tool used to create test cases for fuzzing of structured text inputs, such as markup and script. It takes a custom high-level grammar format as input, and produces random well-formed test cases as output – it can be used as a grammar fuzzing tool.

API programming is complex and subtle programming mistakes in new code can introduce annoying crashes and even serious security vulnerabilities that can be triggered by malformed input which can lead to headaches for the user and security exposure.

Dharma - Generation-based Context-free Grammar Fuzzing Tool

WebAPIs start life as a specification in the form of an Interface Description Language, or IDL. Since this is essentially a grammar, a grammar-based fuzzer becomes a valuable tool in finding security issues in new WebAPIs because it ensures that expected semantics are followed most of the time, while still exploring enough undefined behaviour to produce interesting results.

Features

  • Persistent variable tracking and cross-reference support
  • Intuitive cross-referencing and meta function syntax
  • Automatic leaf node bias after deep graph recursions
  • Internal constant overriding for greater configurability
  • Templated prefix and suffix outputs

Apart from the original features listed above the guys from Mozilla dragged Dharma out of 2012 and gave it a good working over. They improved the way it parses grammars and optimized the speed of parsing and the generating of fuzzed output, added new grammar features to the grammar specification, added support for serving testcases over a WebSocket server, and made it Python 3 ready.

Usage

Generate a single test-case.

Generate a single test case with multiple grammars.

Generating test-cases as files.

You can download Dharma here:

Dharma-v1.1.zip

Or read more here.


Posted in: Exploits/Vulnerabilities, Hacking Tools, Programming

, , , , , , , ,

Recent in Exploits/Vulnerabilities:
- Mirai DDoS Malware Source Code Leaked
- mimikittenz – Extract Plain-Text Passwords From Memory
- Massive Yahoo Hack – 500 Million Accounts Compromised

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 236,502 views
- AJAX: Is your application secure enough? - 120,376 views
- eEye Launches 0-Day Exploit Tracker - 85,869 views


Comments are closed.