Proper way to submit data

[zinzloun]

I appreciate your help since I cannot find the proper way to script boofuzz in order to replicate the following in my LAB enviroment

• I have a remote service, IP 192.168.1.X.X listen on TCP 12345 that accept an input value
• Interacting with it using nc I am able to crash it with a bunch of A:
  
• Piping the payload I am able to crash again the service:
  

My scritp looks as follows:
`...

ses = Session(target = Target(connection = SocketConnection(host, port, proto='tcp')))

s_initialize("CM_Service")

s_string("FUZZ")

s_string("\r", fuzzable = False)

ses.connect(s_get("CM_Service"))

ses.fuzz()

....
`
The fuzzing process ends without crashing the sevice. Can you give a hint about how to script it in the proper manner?
TIA
Philip

[cq674350529]

If only a long string value (>150) would crash the remote service, it should work. If not, you can use the wireshark or tcpdump to capture the packet, and analyze what has been sent to the remote target.

[hackathi]

You only send a carriage return, try sending a newline as well. Windows line endings are \r\n, and depending on the source of your target it may accept a single \n as well.

Try this:

ses = Session(target = Target(connection = SocketConnection(host, port, proto='tcp')))

s_initialize("CM_Service")
s_string("FUZZ")
s_string("\r\n", fuzzable = False)

ses.connect(s_get("CM_Service"))

ses.fuzz()

[zinzloun]

@mistressofjellyfish
You are definitely right. Adding \n in the script made the service crash!

@cq674350529
Inspecting the request with Wireshark confirmed that was the problem

Can I abuse of your kind support asking another question?
Since I'm able to crash the server, how can I control the Restarting target step, since I'd like to stop the fuzzing process after 5 attempts (for istance)?
It seems to go on indefinitely, I'd like to know how to proper manage this situation instead to use the keyboard interrupt:

I took a look at the doc, I tried to use the parameters:

• crash_threshold_element
• crash_threshold_request

with no luck. It seems to me that the proper way is to set an handler but I'm not able to understand which one and how to code it. Could you please give me a hint about that?
Thank you for this wonderful tool
P.

[SR4ven]

Glad to see that you were able to fix your problem @zinzloun!

As for your second question, one of the session parameters restart_threshold or restart_timeout should fix your problem.
Alternatively you could write your own monitor that checks if the target is still up and reports failures. That's when crash_threshold_element and crash_threshold_request would take effect.

[zinzloun]

@SR4ven
I dont see any session parameters named restart_threshold or restart_timeout, anyway I will try to implement my own monitor as you suggested.
Thank you

[hackathi]

As an aside: the monitor interface has changed drastically from the release version to the current master. If possible for you, install from source and use that version, using custom monitors is more documented there.

[SR4ven]

@zinzloun you're right, these options are not released to pip yet. You could install boofuzz from source as described here. That should give you access to those options.

[zinzloun]

@SR4ven ...and you were right suggesting to install from source, then I was able to configure the threshold as follows:
ses = Session(target = Target(connection = SocketConnection(host, port, proto='tcp')),restart_threshold = 5)
and it works exactly as expected, so thank you very much, @mistressofjellyfish as well.
Philip