This is a story about how I used google dorking to find sensitive information exposed in a private VDP program. This is a rather short…Continue reading on Medium » (https://mikekitckchan.medium.com/from-google-dorking-to-information-disclosure-5da4f1d771e5?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
From Google Dorking to Information Disclosure
This is a story about how I used google dorking to find sensitive information exposed in a private VDP program. This is a rather short…
Recommendations for writing custom back doors and obfuscation
https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/
I am in my senior year of my Bachelor’s in cybersecurity and network management. I have learned a great deal about system scans, finding unpatched vulnerabilities, and using tools like metasploit or routersploit to exploit known vulnerabilities. I, however am wanting to spend some time learning how to write my own back doors and the best ways to obfuscate them for use in phishing. It seems to me that social engineering is a more effective way for delivering payloads than crossing your fingers and hoping for a zero day or non-existent patch. So here is my question: Do you all recommend me learning up on powershell and then using Java to execute and obfuscate the payload? Or do you all recommend starting with python back doors and doing string obfuscation using python commands? Or do you recommend something completely different? Any and all recommendations and info are greatly appreciated. submitted by /u/Tiny-Personality-887 (https://www.reddit.com/user/Tiny-Personality-887)
[link] (https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/
I am in my senior year of my Bachelor’s in cybersecurity and network management. I have learned a great deal about system scans, finding unpatched vulnerabilities, and using tools like metasploit or routersploit to exploit known vulnerabilities. I, however am wanting to spend some time learning how to write my own back doors and the best ways to obfuscate them for use in phishing. It seems to me that social engineering is a more effective way for delivering payloads than crossing your fingers and hoping for a zero day or non-existent patch. So here is my question: Do you all recommend me learning up on powershell and then using Java to execute and obfuscate the payload? Or do you all recommend starting with python back doors and doing string obfuscation using python commands? Or do you recommend something completely different? Any and all recommendations and info are greatly appreciated. submitted by /u/Tiny-Personality-887 (https://www.reddit.com/user/Tiny-Personality-887)
[link] (https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/pqrir2/recommendations_for_writing_custom_back_doors_and/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Recommendations for writing custom back doors and obfuscation
I am in my senior year of my Bachelor’s in cybersecurity and network management. I have learned a great deal about system scans, finding unpatched...
BatchQL - GraphQL Security Auditing Script With A Focus On Performing Batch GraphQL Queries And Mutations
http://www.kitploit.com/2021/09/batchql-graphql-security-auditing.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/09/batchql-graphql-security-auditing.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
BatchQL - GraphQL Security Auditing Script With A Focus On Performing Batch GraphQL Queries And Mutations
BatchQL is a GraphQL security auditing (https://www.kitploit.com/search/label/Auditing) script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks. GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.
Detections
This tool is capable of detecting the following: Introspection query support Schema suggestions detection Potential CSRF detection Query name based batching Query JSON list based batching
Attacks
Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded (https://www.kitploit.com/search/label/Embedded) in the query, or where they are provided in the JSON input.
Usage
Enumeration
❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080
Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyance
CSRF GET based successful. Please confirm that this is a valid issue.
CSRF POST based successful. Please confirm that this is a valid issue.
Query name based batching: GraphQL batching is possible... preflight request was successful.
Query JSON list based batching: GraphQL batching is possible... preflight request was successful.
Most provide query, wordlist, and size to perform batching attack.
Batching Attacks
Save a file that contains your GraphQL query i.e. acc-login.txt: mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) {
emailLoginRemembered(loginInput: $loginInput) {
authToken {
accessToken
__typename
}
userSessionResponse {
userToken
userIdentity {
userId
identityType
verified
onboardingStatus
registrationReferralCode
userReferralInfo {
referralCode {
code
valid
__typename
}
__typename
}
__typename
}
__typename
}
__typename
}
}
Run the following command to run a GraphQL batching attack: ❯ python batch.py --query acc-login.txt --wordlist passwords.txt -v '{"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}' --size 100 -e http://re.local:5000/graphiql -p localhost:8080
The above command does the following: Specifies a query from a local file --query acc-login.txt. Specifies a wordlist (https://www.kitploit.com/search/label/Wordlist) --wordlist passwords.txt Specifies the variable input with the replacement identifier (https://www.kitploit.com/search/label/Identifier) -v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}} Specifies the batch size --size 100 Specifies the endpoint -e http://re.local:5000/graphiql Specifies a proxy -p localhost:8080
References
Exploiting GraphQL (https://blog.assetnote.io/2021/08/29/exploiting-graphql/) Damn (https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application)Vulnerable (https://www.kitploit.com/search/label/Vulnerable) GraphQL Application GraphQL Batching Attack - Wallarm (https://lab.wallarm.com/graphql-batching-attack/) Mitigating Batching Attacks (https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#mitigating-batching-attacks)
Download Batchql (https://github.com/assetnote/batchql)
___________________________
@hacking_Attack
@Hacking_Video
Detections
This tool is capable of detecting the following: Introspection query support Schema suggestions detection Potential CSRF detection Query name based batching Query JSON list based batching
Attacks
Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded (https://www.kitploit.com/search/label/Embedded) in the query, or where they are provided in the JSON input.
Usage
Enumeration
❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080
Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyance
CSRF GET based successful. Please confirm that this is a valid issue.
CSRF POST based successful. Please confirm that this is a valid issue.
Query name based batching: GraphQL batching is possible... preflight request was successful.
Query JSON list based batching: GraphQL batching is possible... preflight request was successful.
Most provide query, wordlist, and size to perform batching attack.
Batching Attacks
Save a file that contains your GraphQL query i.e. acc-login.txt: mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) {
emailLoginRemembered(loginInput: $loginInput) {
authToken {
accessToken
__typename
}
userSessionResponse {
userToken
userIdentity {
userId
identityType
verified
onboardingStatus
registrationReferralCode
userReferralInfo {
referralCode {
code
valid
__typename
}
__typename
}
__typename
}
__typename
}
__typename
}
}
Run the following command to run a GraphQL batching attack: ❯ python batch.py --query acc-login.txt --wordlist passwords.txt -v '{"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}' --size 100 -e http://re.local:5000/graphiql -p localhost:8080
The above command does the following: Specifies a query from a local file --query acc-login.txt. Specifies a wordlist (https://www.kitploit.com/search/label/Wordlist) --wordlist passwords.txt Specifies the variable input with the replacement identifier (https://www.kitploit.com/search/label/Identifier) -v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}} Specifies the batch size --size 100 Specifies the endpoint -e http://re.local:5000/graphiql Specifies a proxy -p localhost:8080
References
Exploiting GraphQL (https://blog.assetnote.io/2021/08/29/exploiting-graphql/) Damn (https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application)Vulnerable (https://www.kitploit.com/search/label/Vulnerable) GraphQL Application GraphQL Batching Attack - Wallarm (https://lab.wallarm.com/graphql-batching-attack/) Mitigating Batching Attacks (https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#mitigating-batching-attacks)
Download Batchql (https://github.com/assetnote/batchql)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
BatchQL - GraphQL Security Auditing Script With A Focus On Performing Batch GraphQL Queries And Mutations
BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks. GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.Detections This tool is capable of detecting the following: Introspection query support Schema suggestions detection Potential CSRF detection Query name based batching Query JSON list based batching Attacks Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input. Usage Enumeration ❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyanceCSRF GET based successful. Please confirm that this is a valid issue.CSRF POST based successful. Please confirm that this is a valid issue.Query name based batching: GraphQL batching is possible... preflight request was successful.Query JSON list based batching: GraphQL batching is possible... preflight request was successful.Most provide query, wordlist, and size to perform batching attack. Batching Attacks Save a file that contains your GraphQL query i.e. acc-login.txt: mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) { emailLoginRemembered(loginInput: $loginInput) { authToken { accessToken _typename } userSessionResponse { userToken userIdentity { userId identityType verified onboardingStatus registrationReferralCode userReferralInfo { referralCode { code valid _typename } _typename } _typename } _typename } _typename } } Run the following command to run a GraphQL batching attack: ❯ python batch.py --query acc-login.txt --wordlist passwords.txt -v '{"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}' --size 100 -e http://re.local:5000/graphiql -p localhost:8080 The above command does the following: Specifies a query from a local file --query acc-login.txt. Specifies a wordlist --wordlist passwords.txt Specifies the variable input with the replacement identifier -v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}} Specifies the batch size --size 100 Specifies the endpoint -e http://re.local:5000/graphiql Specifies a proxy -p localhost:8080 References Exploiting GraphQL Damn Vulnerable GraphQL Application GraphQL Batching Attack - Wallarm Mitigating Batching Attacks Download Batchql
Read more...
___________________________
@hacking_Attack
@Hacking_Video
BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks. GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.Detections This tool is capable of detecting the following: Introspection query support Schema suggestions detection Potential CSRF detection Query name based batching Query JSON list based batching Attacks Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input. Usage Enumeration ❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyanceCSRF GET based successful. Please confirm that this is a valid issue.CSRF POST based successful. Please confirm that this is a valid issue.Query name based batching: GraphQL batching is possible... preflight request was successful.Query JSON list based batching: GraphQL batching is possible... preflight request was successful.Most provide query, wordlist, and size to perform batching attack. Batching Attacks Save a file that contains your GraphQL query i.e. acc-login.txt: mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) { emailLoginRemembered(loginInput: $loginInput) { authToken { accessToken _typename } userSessionResponse { userToken userIdentity { userId identityType verified onboardingStatus registrationReferralCode userReferralInfo { referralCode { code valid _typename } _typename } _typename } _typename } _typename } } Run the following command to run a GraphQL batching attack: ❯ python batch.py --query acc-login.txt --wordlist passwords.txt -v '{"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}' --size 100 -e http://re.local:5000/graphiql -p localhost:8080 The above command does the following: Specifies a query from a local file --query acc-login.txt. Specifies a wordlist --wordlist passwords.txt Specifies the variable input with the replacement identifier -v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}} Specifies the batch size --size 100 Specifies the endpoint -e http://re.local:5000/graphiql Specifies a proxy -p localhost:8080 References Exploiting GraphQL Damn Vulnerable GraphQL Application GraphQL Batching Attack - Wallarm Mitigating Batching Attacks Download Batchql
Read more...
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Free red teaming tools
https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/
<!-- SC_OFF -->Found this while looking up something else security related. Thought it might be useful to some people. Did not see it anywhere on here and I am not sure if I got the flair right. https://cybersecuritynews.com/free-red-teaming-tools/ <!-- SC_ON --> submitted by /u/JDrisc3480 (https://www.reddit.com/user/JDrisc3480)
[link] (https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/) [comments] (https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/)
https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/
<!-- SC_OFF -->Found this while looking up something else security related. Thought it might be useful to some people. Did not see it anywhere on here and I am not sure if I got the flair right. https://cybersecuritynews.com/free-red-teaming-tools/ <!-- SC_ON --> submitted by /u/JDrisc3480 (https://www.reddit.com/user/JDrisc3480)
[link] (https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/) [comments] (https://www.reddit.com/r/redteamsec/comments/pquu3w/free_red_teaming_tools/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!BatchQL - GraphQL Security Auditing Script With A Focus On Performing Batch GraphQL Queries And Mutations
BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements.
When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks.
GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.
Detections
This tool is capable of detecting the following:
* Introspection query support
* Schema suggestions detection
* Potential CSRF detection
* Query name based batching
* Query JSON list based batching
Attacks
Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input.
Usage
Enumeration
Batching Attacks
1. Save a file that contains your GraphQL query i.e.
1. Run the following command to run a GraphQL batching attack:
The above command does the following:
* Specifies a query from a local file
* Specifies a wordlist
* Specifies the variable input with the replacement identifier
* Specifies the batch size
* Specifies the endpoint
* Specifies a proxy
References
* Exploiting GraphQL
* Damn Vulnerable GraphQL Application
* GraphQL Batching Attack - Wallarm
* Mitigating Batching Attacks
Download Batchql
BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements.
When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks.
GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.
Detections
This tool is capable of detecting the following:
* Introspection query support
* Schema suggestions detection
* Potential CSRF detection
* Query name based batching
* Query JSON list based batching
Attacks
Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input.
Usage
Enumeration
❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080
Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyance
CSRF GET based successful. Please confirm that this is a valid issue.
CSRF POST based successful. Please confirm that this is a valid issue.
Query name based batching: GraphQL batching is possible... preflight request was successful.
Query JSON list based batching: GraphQL batching is possible... preflight request was successful.
Most provide query, wordlist, and size to perform batching attack.
Batching Attacks
1. Save a file that contains your GraphQL query i.e.
acc-login.txt:mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) {
emailLoginRemembered(loginInput: $loginInput) {
authToken {
accessToken
__typename
}
userSessionResponse {
userToken
userIdentity {
userId
identityType
verified
onboardingStatus
registrationReferralCode
userReferralInfo {
referralCode {
code
valid
__typename
}
__typename
}
__typename
}
__typename
}
__typename
}
}
1. Run the following command to run a GraphQL batching attack:
❯ python batch.py --query acc-login.txt --wordlist passwords.txt -v '{"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}' --size 100 -e http://re.local:5000/graphiql -p localhost:8080
The above command does the following:
* Specifies a query from a local file
--query acc-login.txt.* Specifies a wordlist
--wordlist passwords.txt* Specifies the variable input with the replacement identifier
-v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}* Specifies the batch size
--size 100* Specifies the endpoint
-e http://re.local:5000/graphiql* Specifies a proxy
-p localhost:8080References
* Exploiting GraphQL
* Damn Vulnerable GraphQL Application
* GraphQL Batching Attack - Wallarm
* Mitigating Batching Attacks
Download Batchql
hacking: security in practice
Is it possible to manipulate nxbus ticket? Uk
Need help can't afford 4pound a dat
submitted by /u/jedid123
[link] [comments]
Is it possible to manipulate nxbus ticket? Uk
Need help can't afford 4pound a dat
submitted by /u/jedid123
[link] [comments]
reddit
Is it possible to manipulate nxbus ticket? Uk
Need help can't afford 4pound a dat
Cloud Security
https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/
<!-- SC_OFF -->Could someone link resources for learning about cloud security? <!-- SC_ON --> submitted by /u/proccpuinfo (https://www.reddit.com/user/proccpuinfo)
[link] (https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/)
https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/
<!-- SC_OFF -->Could someone link resources for learning about cloud security? <!-- SC_ON --> submitted by /u/proccpuinfo (https://www.reddit.com/user/proccpuinfo)
[link] (https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/) [comments] (https://www.reddit.com/r/redteamsec/comments/pr070v/cloud_security/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsFpicker : A Frida-based Fuzzing Suite Supporting Various Modes
Fpicker is a Frida-based fuzzing suite that offers a variety of fuzzing modes for in-process fuzzing, such as an AFL++ mode or a passive tracing mode. It should run on all platforms that are supported by Frida.
* Installation Instructions
* Building and Running
* Creating a Fuzzing Harness
* Modes and Configuration
Some background information and the thoughts and ideas behind fpicker can be found in a blogpost I wrote.
Fpicker is based on previous efforts on ToothPicker, which was developed during my master thesis. Most of fpicker was developed during working hours at my employer (ERNW).
Requirements and Installation
Required for running fpicker:
* frida_compile to compile the harness script into one JS file
* The
* depending on the platform you want to target store the library as
Required only when running in AFL++ mode:
* AFL++
* on macOS:
* Compile with
* on iOS:
* Apply the aflpp-ios.patch. This changes the shared mem and out file mode to 666 instead of 600. Fpicker needs to be run as root on iOS. If the target is not running as root, it will not be able to read and write shared memory.
* Compile with
Building and Running
Fpicker can be built for
Depending on the desired target run:
make fpicker-macos
make fpicker-ios
make fpicker-linux
to build fpicker.
Once fpicker is built, the fuzzing harness needs to be built next:
See the examples folder for different sample fuzzing cases. The general approach is as follows:
* Create a custom harness for the target (e.g.
* Compile the custom harness using frida-compile
Now fpicker can start fuzzing. The exact command highly depends on the configuration and setup. In the following, a few example cases are given. These mostly correspond to the examples in the examples folder.
* Run fpicker as AFL++ proxy attaching to a target process fuzzing a specific function in process:
afl-fuzz -i examples/test-network/in -o ./examples/test-network/out — \
./fpicker –fuzzer-mode afl -e attach -p test-network -f ./examples/test-network/harness.js
* Run fpicker in standalone mode attaching to a server and running a client program to send the fuzzing input:
./fpicker –fuzzer-mode standalone -e attach -p server-process -f harness.js –input-mode cmd \
–command “./client-send @@” -i indir -o outdir
* Run fpicker in standalone mode attaching to a server, fuzzing in-process with a custom mutator cmd:
./fpicker –fuzzer-mode active –communication-mode shm -e attach -p server-process -f harness.js \
-i indir -o outdir –standalone-mutator cmd –mutator-command “radamsa”
* Run fpicker in passive mode attaching to a server collecting coverage and payloads:
* ./fpicker –fuzzer-mode passive –communication-mode send -e attach -p server-process -o outdir -f harness.js
*
* Run fpicker in standalone mode attaching to a running process on a remote device, fuzzing in-process with a custom mutator cmd:
./fpicker –fuzzer-mode active -e attach -p test -D [...]
Fpicker is a Frida-based fuzzing suite that offers a variety of fuzzing modes for in-process fuzzing, such as an AFL++ mode or a passive tracing mode. It should run on all platforms that are supported by Frida.
* Installation Instructions
* Building and Running
* Creating a Fuzzing Harness
* Modes and Configuration
Some background information and the thoughts and ideas behind fpicker can be found in a blogpost I wrote.
Fpicker is based on previous efforts on ToothPicker, which was developed during my master thesis. Most of fpicker was developed during working hours at my employer (ERNW).
Requirements and Installation
Required for running fpicker:
* frida_compile to compile the harness script into one JS file
* The
frida-core-devkit for the respective platform found at Frida releases on GitHub* depending on the platform you want to target store the library as
frida-core-ios.a, frida-core-macos.a, or frida-core-linux.a. Also, linux and macOS/iOS apparently have different header files.Required only when running in AFL++ mode:
* AFL++
* on macOS:
* Compile with
CFLAGS="-DUSEMMAP=1".* on iOS:
* Apply the aflpp-ios.patch. This changes the shared mem and out file mode to 666 instead of 600. Fpicker needs to be run as root on iOS. If the target is not running as root, it will not be able to read and write shared memory.
* Compile with
CFLAGS="-DUSEMMAP=1".Building and Running
Fpicker can be built for
macOS, iOS or Linux. The Makefile currently only supports building for iOS on macOS but it should be totally possible to build fpicker using an iOS toolchain on Linux.Depending on the desired target run:
make fpicker-macos
make fpicker-ios
make fpicker-linux
to build fpicker.
Once fpicker is built, the fuzzing harness needs to be built next:
See the examples folder for different sample fuzzing cases. The general approach is as follows:
* Create a custom harness for the target (e.g.
examples/test/test.js) (see here for more information on harnesses)* Compile the custom harness using frida-compile
frida-compile test.js -o harness.jsNow fpicker can start fuzzing. The exact command highly depends on the configuration and setup. In the following, a few example cases are given. These mostly correspond to the examples in the examples folder.
* Run fpicker as AFL++ proxy attaching to a target process fuzzing a specific function in process:
afl-fuzz -i examples/test-network/in -o ./examples/test-network/out — \
./fpicker –fuzzer-mode afl -e attach -p test-network -f ./examples/test-network/harness.js
* Run fpicker in standalone mode attaching to a server and running a client program to send the fuzzing input:
./fpicker –fuzzer-mode standalone -e attach -p server-process -f harness.js –input-mode cmd \
–command “./client-send @@” -i indir -o outdir
* Run fpicker in standalone mode attaching to a server, fuzzing in-process with a custom mutator cmd:
./fpicker –fuzzer-mode active –communication-mode shm -e attach -p server-process -f harness.js \
-i indir -o outdir –standalone-mutator cmd –mutator-command “radamsa”
* Run fpicker in passive mode attaching to a server collecting coverage and payloads:
* ./fpicker –fuzzer-mode passive –communication-mode send -e attach -p server-process -o outdir -f harness.js
*
* Run fpicker in standalone mode attaching to a running process on a remote device, fuzzing in-process with a custom mutator cmd:
./fpicker –fuzzer-mode active -e attach -p test -D [...]