diff --git a/proxyfuzz.py b/proxyfuzz.py
index 1cd7d5f..f23cda3 100644
--- a/proxyfuzz.py
+++ b/proxyfuzz.py
@@ -1,13 +1,31 @@
-# Proxyfuzz: a TCP and UDP proxy man-in-the-middle fuzzer
-# v 0.1
-# By Rodrigo Marcos
-# http://www.theartoffuzzing.com
+
+#!/usr/bin/python3
+# Proxyfuzz - On the fly TCP and UDP network fuzzer
+# Copyright (C) 2011 Rodrigo Marcos
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+# Proxyfuzz: a TCP and UDP proxy man-in-the-middle fuzzer
+# v 0.1
+# By Rodrigo Marcos
+# http://www.secforce.co.uk
from twisted.protocols import portforward
from twisted.internet.protocol import DatagramProtocol
from twisted.internet import reactor
import getopt, sys
-from random import randint
+from random import randint, randrange
# UDP Proxy stuff
@@ -21,7 +39,7 @@ def __init__(self, server, host, port):
def startProtocol(self):
self.transport.connect(desthost, destport)
- def datagramReceived(self, data, (host, port)):
+ def datagramReceived(self, data, host_port):
global verbose
global notuntil
global request
@@ -33,15 +51,17 @@ def datagramReceived(self, data, (host, port)):
else:
data = fuzz(data)
if verbose:
- print "Server ------> Client"
- print "%r" % data
+ print("Server ------> Client")
+ print(data)
+ addr=(self.host, self.port)
+ self.server.transport.write(data, addr)
- self.server.transport.write(data, (self.host, self.port))
class Server(DatagramProtocol):
client = None
- def datagramReceived(self, data, (host, port)):
+ def datagramReceived(self, data, host_port):
+ host, port = host_port
if not self.client or self.client.host != host or self.client.port != port:
self.client = Client(self, host, port)
reactor.listenUDP(0, self.client)
@@ -57,9 +77,11 @@ def datagramReceived(self, data, (host, port)):
else:
data = fuzz(data)
if verbose:
- print "Client ------> Server"
- print "%r" % data
- self.client.transport.write(data, (desthost, destport))
+ print("Client ------> Server")
+ print(data)
+ addr=(desthost, destport)
+ self.client.transport.write(data, addr)
+
# TCP proxy stuff
@@ -76,13 +98,15 @@ def server_dataReceived(self, data):
data = fuzz(data)
if verbose:
- print "Client ------> server"
- print "%r" % data
+ print("Client ------> server")
+ print(data)
portforward.Proxy.dataReceived(self, data)
+
portforward.ProxyServer.dataReceived = server_dataReceived
+
def client_dataReceived(self, data):
global verbose
global notuntil
@@ -95,67 +119,80 @@ def client_dataReceived(self, data):
else:
data = fuzz(data)
if verbose:
- print "Server ------> Client"
- print "%r" % data
+ print("Server ------> Client")
+ print(data)
portforward.Proxy.dataReceived(self, data)
+
portforward.ProxyClient.dataReceived = client_dataReceived
+overflowstrings = ["A" * 255, "A" * 256, "A" * 257, "A" * 420, "A" * 511, "A" * 512, "A" * 1023, "A" * 1024, "A" * 2047,
+ "A" * 2048, "A" * 4096, "A" * 4097, "A" * 5000, "A" * 10000, "A" * 20000, "A" * 32762, "A" * 32763,
+ "A" * 32764, "A" * 32765, "A" * 32766, "A" * 32767, "A" * 32768, "A" * 65534, "A" * 65535,
+ "A" * 65536, "%x" * 1024, "%n" * 1025, "%s" * 2048, "%s%n%x%d" * 5000, "%s" * 30000, "%s" * 40000,
+ "%.1024d", "%.2048d", "%.4096d", "%.8200d", "%99999999999s", "%99999999999d", "%99999999999x",
+ "%99999999999n", "%99999999999s" * 1000, "%99999999999d" * 1000, "%99999999999x" * 1000,
+ "%99999999999n" * 1000, "%08x" * 100, "%%20s" * 1000, "%%20x" * 1000, "%%20n" * 1000, "%%20d" * 1000,
+ "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"]
-overflowstrings = ["A" * 255, "A" * 256, "A" * 257, "A" * 420, "A" * 511, "A" * 512, "A" * 1023, "A" * 1024, "A" * 2047, "A" * 2048, "A" * 4096, "A" * 4097, "A" * 5000, "A" * 10000, "A" * 20000, "A" * 32762, "A" * 32763, "A" * 32764, "A" * 32765, "A" * 32766, "A" * 32767, "A" * 32768, "A" * 65534, "A" * 65535, "A" * 65536, "%x" * 1024, "%n" * 1025 , "%s" * 2048, "%s%n%x%d" * 5000, "%s" * 30000, "%s" * 40000, "%.1024d", "%.2048d", "%.4096d", "%.8200d", "%99999999999s", "%99999999999d", "%99999999999x", "%99999999999n", "%99999999999s" * 1000, "%99999999999d" * 1000, "%99999999999x" * 1000, "%99999999999n" * 1000, "%08x" * 100, "%%20s" * 1000,"%%20x" * 1000,"%%20n" * 1000,"%%20d" * 1000, "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"]
def bitflipping(data):
l = len(data)
- n = int(l*7/100) # 7% of the bytes to be modified
+ n = int(l * 7 / 100) # 7% of the bytes to be modified
- for i in range(0,n): # We change the bytes
- r = randint(0,l-1)
- data = data[0:r] + chr(randint(0,255)) + data[r+1:]
+ for i in range(0, n): # We change the bytes
+ r = randint(0, l - 1)
+ data = data[0:r] + str.encode(chr(randrange(0, 255))) + data[r + 1:]
return data
+
def bofinjection(data):
l = len(data)
- r = randint(0,len(overflowstrings)-1)
- data = data[0:r] + overflowstrings[r] + data[r-l:]
+ r = randint(0, len(overflowstrings) - 1)
+ data = data[0:r] + str.encode(overflowstrings[r]) + data[r - l:]
return data
-def fuzz(data):
- r = randint(0,5)
- if r==0:
+def fuzz(data):
+ r = randint(0, 5)
+ if r == 0:
data = bitflipping(data)
- r = randint(0,5)
- if r==0:
+ r = randint(0, 5)
+ if r == 0:
data = bofinjection(data)
return data
+
def startudpproxy():
reactor.listenUDP(localport, Server())
reactor.run()
+
def starttcpproxy():
reactor.listenTCP(localport, portforward.ProxyFactory(desthost, destport))
reactor.run()
+
def usage():
- #print "###############################################################"
- print
- print "ProxyFuzz 0.1, Simple fuzzing proxy by Rodrigo Marcos"
- print "https://www.secforce.com"
- print
- print "usage():"
- #print
- print "python proxyfuzz -l -r -p [options]"
- print
- print " [options]"
- print " -c: Fuzz only client side (both otherwise)"
- print " -s: Fuzz only server side (both otherwise)"
- print " -w: Number of requests to send before start fuzzing"
- print " -u: UDP protocol (otherwise TCP is used)"
- print " -v: Verbose (outputs network traffic)"
- print " -h: Help page"
+ # print "###############################################################"
+ # use 'ulimit -n 4096' when too mane open files
+ print('')
+ print("ProxyFuzz 0.1, Simple fuzzing proxy by Rodrigo Marcos")
+ print("http://www.secforce.co.uk")
+ print('')
+ print("usage():")
+ print('')
+ print("proxyfuzz -l -r -p [options]")
+ print('')
+ print(" [options]")
+ print(" -c: Fuzz only client side (both otherwise)")
+ print(" -s: Fuzz only server side (both otherwise)")
+ print(" -w: Number of requests to send before start fuzzing")
+ print(" -u: UDP protocol (otherwise TCP is used)")
+ print(" -v: Verbose (outputs network traffic)")
+ print(" -h: Help page")
verbose = False
@@ -167,6 +204,8 @@ def usage():
destport = 0
testclient = 1
testserver = 1
+
+
def main():
global verbose
global notuntil
@@ -188,38 +227,39 @@ def main():
usage()
sys.exit()
if o == "-l":
- localport=int(a)
+ localport = int(a)
if o == "-r":
- desthost=a
+ desthost = a
if o == "-p":
- destport=int(a)
+ destport = int(a)
if o == "-v":
verbose = True
if o == "-w":
- notuntil=int(a)
+ notuntil = int(a)
if o == "-u":
- proto="udp"
- if o == "-c": # Only client
- testserver=0
- if o == "-s": # Only server
- testclient=0
+ proto = "udp"
+ if o == "-c": # Only client
+ testserver = 0
+ if o == "-s": # Only server
+ testclient = 0
except:
usage()
sys.exit(2)
- if testserver==0 and testclient==0:
+ if testserver == 0 and testclient == 0:
usage()
sys.exit(2)
- elif localport==0 or desthost=="" or destport==0:
+ elif localport == 0 or desthost == "" or destport == 0:
usage()
sys.exit(2)
else:
- if proto=="tcp":
+ if proto == "tcp":
starttcpproxy()
- else: # UDP
+ else: # UDP
startudpproxy()
+
if __name__ == "__main__":
-main()
\ No newline at end of file
+ main()