bugtraq - AUTODAFE: an Act of Software Torture [FUZZER]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 05 Aug 2006 01:33:25 +0200
From: Martin Vuagnoux <autodafe@...gnoux.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: AUTODAFE: an Act of Software Torture [FUZZER]

Dear list,

let me present you the public release of a fuzzer presented at 22c3:

Autodafé is a fuzzing framework able to uncover buffer overflows by 
using the fuzzing by weighting attacks with markers technique.

http://autodafe.sourceforge.net

You will find a paper explaining the technique used, the slides of the 
presentation and the source code. It uses a script language largely 
inspired by Spike (btw: thanks Dave). The major improvement is the use 
of a debugger in order to reduce the test space. There is a tutorial 
(based on real cases) which explains how to use it, to fuzz network 
based (TCP/UDP) protocols (client and server side) and files (lps, pdf, 
jpeg, etc.) The second major improvement is the use of dissector 
(etheral, wireshark) to automatically recognize 750 network based 
protocols.

Feel free to give feedback, it's a beta release.

Enjoy 8^P

Martin Vuagnoux