How boofuzz detect crashes and log crashed test cases

[bjchan9an]

We are using boofuzz for fuzzing remote service with tcp protocol. The fuzzer script is as follows.

session = Session(target = Target(connection = SocketConnection(host, port, proto='tcp')))
s_initialize("Test")
s_string("Fuzz", fuzzable = True)
session.connect(s_get("Test"))
session.fuzz()

After a while, we noticed the remote service is crashed but the fuzzer just repeatly tried to restart. The fuzzer did not detect the remote service is closed and the crashed test case is not stored.

[2022-02-02 04:18:42,231]    Test Step: Restarting target
[2022-02-02 04:18:42,231]     Info: Restarting target process using CallbackMonitor
[2022-02-02 04:18:42,231]    Test Step: Cleaning up connections from callbacks
[2022-02-02 04:18:42,231]     Info: Closing target connection...
[2022-02-02 04:18:42,231]     Info: Connection closed.
[2022-02-02 04:18:42,231]     Info: No reset handler available... sleeping for 5 seconds
[2022-02-02 04:18:47,236]     Info: Opening target connection (xxx)...
[2022-02-02 04:18:47,237]     Info: Cannot connect to target; retrying. Note: This likely indicates a failure caused by the previous test case, or a target that is slow to restart.
[2022-02-02 04:18:47,237]    Test Step: Restarting target
[2022-02-02 04:18:47,237]     Info: Restarting target process using CallbackMonitor
[2022-02-02 04:18:47,237]    Test Step: Cleaning up connections from callbacks
[2022-02-02 04:18:47,237]     Info: Closing target connection...
[2022-02-02 04:18:47,237]     Info: Connection closed.
[2022-02-02 04:18:47,237]     Info: No reset handler available... sleeping for 5 seconds
[2022-02-02 04:18:52,243]     Info: Opening target connection (xxx)...
[2022-02-02 04:18:52,244]     Info: Cannot connect to target; retrying. Note: This likely indicates a failure caused by the previous test case, or a target that is slow to restart.

How can we customize the boofuzz script so that:

1. we can detect the remote service is closed (e.g., try tcp connect)?
2. we can store the untruncated crashed test case to disk?

[SR4ven]

Good question, I think you're not the only one who ran into this problem. We could perhaps add a simple example.

1. we can detect the remote service is closed (e.g., try tcp connect)?

You need to define a Monitor class that starts/stops and monitors your target:

class TcpPingMonitor(boofuzz.monitors.BaseMonitor):
    def post_send(self, target=None, fuzz_data_logger=None, session=None):
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            sock.connect((target._target_connection.host, target._target_connection.port))
            return True
        except socket.error as e:
            fuzz_data_logger.log_fail(f"Opening TCP connection failed: {e}")
            return False
        finally:
            sock.close()

    def __repr__(self):
        return "TCP Ping Monitor"

Then add the monitor to your target:

session = Session(
    target=Target(connection=TCPSocketConnection("127.0.0.1", 80),
                  monitors=[TcpPingMonitor()]))

2. we can store the untruncated crashed test case to disk?

With the Session option fuzz_db_keep_only_n_pass_cases=1 you can store only failed test case data in the results database. It is saved to boofuzz-results/run....db which you can open at any time with boo open xxx.db.
If you run into issues with truncated test case data, you could use a different logger like FuzzLoggerCsv or FuzzLoggerText with the session option fuzz_loggers=[FuzzLoggerCsv()].
Those loggers will log every test case, also the successful ones, which might generate really large files.

[jtpereyda]

Nice! I suspect this behavior is generic enough to build into the framework.