ProxyFuzz – MITM Network Fuzzer in Python

Use Netsparker


ProxyFuzz is a man-in-the-middle non-deterministic network fuzzer written in Python. ProxyFuzz randomly changes (fuzzes) contents on the network traffic. It supports TCP and UDP protocols and can also be configured to fuzz only one side of the communication. ProxyFuzz is protocol agnostic so it can randomly fuzz any network communication.

ProxyFuzz is a good tool for quickly testing network protocols and provide with basic proof of concepts. Using this tool you will be amazed by the poor quality of software and you will see clients and servers dying upon unexpected input, just be prepared to see the very weird behaviours.

Syntax of ProxyFuzz:

A demo of ProxyFuzz is available here.

The video shows ProxyFuzz proxying traffic between a VMWare Console and a VMWare Server. This is just a dumb example of the things you can do with this tool.

Download ProxyFuzz 0.1 Source Code

Download ProxyFuzz 0.1 Windows Binary

Or read more here.

Posted in: Hacking Tools, Networking Hacking

, , , , , ,


Latest Posts:


snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.
QualysGuard - Vulnerability Management Tool QualysGuard – Vulnerability Management Tool
QualysGuard is a web-based vulnerability management tool provided by Qualys, Inc, which was the first company to deliver vulnerability management services as a SaaS-based web-service.


3 Responses to ProxyFuzz – MITM Network Fuzzer in Python

  1. dre June 27, 2007 at 10:39 pm #

    interesting. proxy fuzzing is a heuristic-based dissection technique used to automate or improve the performance of fuzz testing. it is not widely known or talked about, but is probably one of the best ways to improve fuzz testing results, especially in a pure black-box scenario (iow: lacking the capability to go gray box via reverse engineering through static binary or bytecode analysis).

    when i first saw this post, i was thinking that proxyfuzzer, a tool by cody pierce of dvlabs (tippingpoint) was released. this tool goes further than ProxyFuzz because it does automatic mutation of plain-text fields. the internal tippingpoint version probably also does binary data, thus being able to change TLV and static values which could mess with parsers on either end of the connection.

    proxy fuzzer (and tons of other new tools) will be available on the fuzzing.org website once it goes live. there were a few things up there the other day, but now it’s password protected for some reason.

  2. Darknet June 29, 2007 at 8:26 am #

    Interesting info dre, I’ll keep an eye on fuzzing.org. http://theartoffuzzing.com/ is currently a good resource too.

  3. Daniel June 30, 2007 at 12:23 am #

    Darknet, i think you should make dre’s comment into a post. It was interesting.