fuzzing - ownesis/libhttp GitHub Wiki

Fuzzing test

HTTP-Header-fuzzer

I create a simple TCP server with fork, HTTP-Header-Fuzzer raise error time-out, but i think the problem come from my TCP server and not LibHTTP.

Github URL

python3 http_header_fuzzer.py -v -uf url.txt -rt -lt -et -ct -uah -csv report.csv

Options used

  • -rt Test if header values appear in HTTP response.
  • -lt Test how the length of a header value affects the HTTP response.
  • -et Test how the application handles special characters as header values.
  • -ct Test how the application handles commands as header values.
  • -uah Fuzz the user agent header.

Report

  • Reflection.
  • Length test.
  • Special char.
  • Command injection.
  • Random User-Agent.

HTTPFuzzer

I am creating a simple HTTP server, the same that I used for HTTP-Header-Fuzzer.

I see on this screenshot that the message host down, check your debugger may happened, so I used the same options as in the README and HTTPFuzzer never returned this message to me, and nothing else in particular happened.

Github URL

python2 HTTPFuzzer.py 192.168.1.6 4444 all 3000

Options used

  • 3000 Path maximum bytes.

all is:

  • Perform fuzzing on http methods [GET, POST, PUT, HEAD].
  • Perform fuzzing on HOST header.
  • Perform fuzzing on user agent header.

Report

  • Methods fuzzing.
  • Host header.
  • User-Agent header.