fuzzing

Fuzzing test

• HTTP-Header-Fuzzer
• HTTPFuzzer

HTTP-Header-fuzzer

I create a simple TCP server with fork, HTTP-Header-Fuzzer raise error time-out, but i think the problem come from my TCP server and not LibHTTP.

Github URL

• HTTP-Header-Fuzzer

python3 http_header_fuzzer.py -v -uf url.txt -rt -lt -et -ct -uah -csv report.csv

Options used

• -rt Test if header values appear in HTTP response.
• -lt Test how the length of a header value affects the HTTP response.
• -et Test how the application handles special characters as header values.
• -ct Test how the application handles commands as header values.
• -uah Fuzz the user agent header.

Report

• Reflection.
• Length test.
• Special char.
• Command injection.
• Random User-Agent.

HTTPFuzzer

I am creating a simple HTTP server, the same that I used for HTTP-Header-Fuzzer.

I see on this screenshot that the message host down, check your debugger may happened, so I used the same options as in the README and HTTPFuzzer never returned this message to me, and nothing else in particular happened.

Github URL

• HTTPFuzzer

python2 HTTPFuzzer.py 192.168.1.6 4444 all 3000

Options used

• 3000 Path maximum bytes.

all is:

• Perform fuzzing on http methods [GET, POST, PUT, HEAD].
• Perform fuzzing on HOST header.
• Perform fuzzing on user agent header.

Report

• Methods fuzzing.
• Host header.
• User-Agent header.