OWASP JBroFuzz Tutorial - Revision history

Yiannis at 09:45, 16 September 2010

2010-09-16T09:45:00Z

Jorge Correa: /* Introduction */

2010-05-26T16:47:59Z

‎Introduction

Jorge Correa: /* Introduction */

2010-05-26T16:47:28Z

‎Introduction

Yiannis at 16:04, 30 March 2010

2010-03-30T16:04:38Z

Yiannis: /* What characters are allowed through? */

2010-03-30T15:50:54Z

‎What characters are allowed through?

Yiannis at 15:47, 30 March 2010

2010-03-30T15:47:35Z

Nathan Sportsman: /* Using JBroFuzz with a Generic Proxy */

2010-03-17T09:39:14Z

‎Using JBroFuzz with a Generic Proxy

Nathan Sportsman at 09:38, 17 March 2010

2010-03-17T09:38:25Z

Nathan Sportsman at 09:30, 17 March 2010

2010-03-17T09:30:47Z

Nathan Sportsman at 09:15, 17 March 2010

2010-03-17T09:15:08Z

@@ Line 1,443: / Line 1,443: @@
 </pre>
 This enables you to have your own (company logo) on JBroFuzz graphs. Further to this, a number of other customization options are available, by right clicking on each of the graph generated.
 [[Category:OWASP_JBroFuzz]]

@@ Line 3: / Line 3: @@
 == Introduction  ==
-''“Si you can’t fuzz with JBroFuzz, you probably do not want to fuzz!”''
+''“If you can’t fuzz with JBroFuzz, you probably do not want to fuzz!”''
 <div align="right">Old JBroFuzz Motto </div>
 <br> The art of teaching, Mark Van Doren said, is the art of assisting discovery. Fuzzing is a representative discipline towards assisting the discovery of security vulnerabilities, that is just beginning to come of age. Over the last two years, through continuous development, JBroFuzz has attempted to expose the intrinsic beauty of the subject: Constantly submit a vast amount of payloads to a service, device or prompt, waiting for the one response that makes all the difference. This is the mentality that JBroFuzz embraces and attempts to offer back to security professionals.

@@ Line 3: / Line 3: @@
 == Introduction  ==
-''“If you can’t fuzz with JBroFuzz, you probably do not want to fuzz!”''
+''“Si you can’t fuzz with JBroFuzz, you probably do not want to fuzz!”''
 <div align="right">Old JBroFuzz Motto </div>
 <br> The art of teaching, Mark Van Doren said, is the art of assisting discovery. Fuzzing is a representative discipline towards assisting the discovery of security vulnerabilities, that is just beginning to come of age. Over the last two years, through continuous development, JBroFuzz has attempted to expose the intrinsic beauty of the subject: Constantly submit a vast amount of payloads to a service, device or prompt, waiting for the one response that makes all the difference. This is the mentality that JBroFuzz embraces and attempts to offer back to security professionals.
@@ Line 15: / Line 15: @@
 There are a number of working examples described here within, which '''grep''' for statements such as “''<nowiki>public static void main(String[] args)</nowiki>''”. The majority of the content relates to reviewing these examples and putting the Java syntax into a fuzzing perspective.
 To summarise, this tutorial focuses on customary and effective usage of fuzzing through the JBroFuzz Java APIs and the respective UI. It is targeting (without attacking them) web applications. Without further redo, let’s get fuzzing!
 == JBroFuzz Basic Functionality  ==

← Older revision		Revision as of 16:04, 30 March 2010
Line 415:		Line 415:

	In total there are 95 printable ASCII characters; minus the one present for space (yes, the one you hit all the time, every day) leaves 94. This fuzzer produces each of those values, in incrementing ASCII order.		In total there are 95 printable ASCII characters; minus the one present for space (yes, the one you hit all the time, every day) leaves 94. This fuzzer produces each of those values, in incrementing ASCII order.
		+
		+	[[Image:020-JBroFuzz-Tutorial.png\|500px\|Measuring Size Length for Single Character ASCII 94 Fuzzing]]
		+
		+	Based on the above graph, the following responses trigger a different response size. Thus the characters blocked by a black-list are:
		+
		+	<pre>
		+	! " , < > @ [ \ ] ^ ` { \| } ~
		+	</pre>
		+
		+	Interesting. Know any payloads that can evade those?
		+	:)

	== JBroFuzz Development Corner ==		== JBroFuzz Development Corner ==

@@ Line 411: / Line 411: @@
 GET /myfilelocation.jsp?lang=en&city=X&rid=97 HTTP/1.1
 </pre>
 == JBroFuzz Development Corner  ==

← Older revision		Revision as of 15:47, 30 March 2010
Line 365:		Line 365:
	[[Image:015-JBroFuzz-Tutorial.png\|500px\|Measuring Hamming Distance for User Enumeration]]		[[Image:015-JBroFuzz-Tutorial.png\|500px\|Measuring Hamming Distance for User Enumeration]]

		+	== Eliminating False Positives: LDAP Injection ==
		+
		+	Every now and then a tool (that does not produce false positives) will hit an application reporting back a huge variety of (hopefully not confirmed, but pending further investigation) injection findings.
		+
		+	Due to the limited number of characters required in performing LDAP Injection, such issues will be high on that list. But let's refresh our memory a bit of how LDAP injection works:
		+
		+	http://www.owasp.org/index.php/LDAP_injection
		+
		+	So typically, during an automated scan, negating LDAP cn-type queries would be submitted and their responses noted. Example:
		+
		+	<pre>
		+	GET /myfilelocation.jsp?lang=en&city=user)(sn=*&rid=97 HTTP/1.1
		+	...
		+	</pre>
		+
		+	vs.
		+
		+	<pre>
		+	GET /myfilelocation.jsp?lang=en&city=user)!(sn=*&rid=97 HTTP/1.1
		+	...
		+	</pre>
		+
		+	or
		+
		+	<pre>
		+	GET /myfilelocation.jsp?lang=en&city=admin)((\|userpassword=)&rid=97 HTTP/1.1
		+	...
		+	</pre>
		+
		+	As great as this check might be from an LDAP perspective, it has a high likelihood of generating false positives, due to the character sets being used. Ergo, a protection mechanism (silly worst-case blacklist present for example) would typically hunt down cross-site scripting and sql injection type of characters:
		+
		+	<pre>
		+	< > ' etc.
		+	</pre>
		+
		+	Not considering =, *, or brackets as completely bad (he says).
		+
		+	=== What characters are allowed through? ===
		+
		+	Enough of all that; we want to know what responses are allowed back and what's different about them for all characters being filtered through a black-list.
		+
		+	Let's transform the above GET into the following and proceed to add a single fuzzer that tells us that:
		+
		+	<pre>
		+	GET /myfilelocation.jsp?lang=en&city=X&rid=97 HTTP/1.1
		+	</pre>
	== JBroFuzz Development Corner ==		== JBroFuzz Development Corner ==

← Older revision		Revision as of 09:39, 17 March 2010
Line 198:		Line 198:

	[[Image:018-JBroFuzz-Tutorial.jpg\|503x449px]]		[[Image:018-JBroFuzz-Tutorial.jpg\|503x449px]]
−

	=== Burp Proxy ===		=== Burp Proxy ===

← Older revision		Revision as of 09:38, 17 March 2010
Line 198:		Line 198:

	[[Image:018-JBroFuzz-Tutorial.jpg\|503x449px]]		[[Image:018-JBroFuzz-Tutorial.jpg\|503x449px]]
		+
		+
		+	=== Burp Proxy ===
		+	In the final example, we are fuzzing through Burp. Similar to Squid, Burp requires absolute URLs in the request. A successful Burp request is shown below.
		+
		+	[[Image:019-JBroFuzz-Tutorial.jpg\|503x449px]]

	== Using JBroFuzz with Paros Proxy ==		== Using JBroFuzz with Paros Proxy ==

@@ Line 181: / Line 181: @@
 With Authentication: &lt;proxy username&gt;:&lt;proxy password&gt;@&lt;proxy server&gt;:&lt;proxy port&gt;
 </pre>
-The structure of the request field and whether the GET parameter is a relative path or not, really depends on the proxy, so you may have to do a bit of trial and error to determine what format your proxy expects. To make all of this a bit clearer lets look at a couple of examples.
+The structure of the request field and whether the GET parameter contains an absolute URL depends on the proxy you are using. For this reason, you may have to do a bit of trial and error to determine what format(s) your proxy accepts. To make all of this a bit clearer lets look at a couple of examples.
 === Squid Proxy  ===

@@ Line 177: / Line 177: @@
 == Using JBroFuzz with a Generic Proxy  ==
-JBrofuzz 2.0 and subsequent releases now include generic proxy support. As of now Basic authentication is supported with a road map to eventually support NTLM and Kerberos authentication as well. We've tried to make the use of a proxy as straight forward as possible. All arguments for the proxy can be passed in the URL field and will take one of the following forms.
+JBrofuzz 2.0 and subsequent releases include generic proxy support. As of this writing, basic authentication is supported with plans to eventually support NTLM and Kerberos authentication as well. We've tried to make the use of a proxy as straight forward as possible. All arguments for the proxy can be passed in the URL field and will take one of the following forms.
 <pre>Without Authentication: &lt;proxy server&gt;:&lt;proxy port&gt;
 With Authentication: &lt;proxy username&gt;:&lt;proxy password&gt;@&lt;proxy server&gt;:&lt;proxy port&gt;
@@ Line 187: / Line 187: @@
 In the first example, we are fuzzing through a squid proxy that requires ncsa user authentication as shown in the figure below. When producing similar results, its important that you use your own proxy and not the one shown in the figure. This proxy was setup for demonstration purposes, will not accept connections from your IP address, and the credentials will no longer be active.
 [[Image:016-JBroFuzz-Tutorial.jpg|503x449px]]
 === Paros Proxy  ===