HTTP Peach Pit Data Sheet

Transcription

1 HTTP Peach Pit Data Sheet Peach Fuzzer, LLC v3.6.94

2 Copyright 2015 Peach Fuzzer, LLC. All rights reserved. This document may not be distributed or used for commercial purposes without the explicit consent of the copyright holders. Peach Fuzzer is a registered trademark of Peach Fuzzer, LLC. Peach Fuzzer contains Patent Pending technologies. While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. Peach Fuzzer, LLC 1122 E Pike St Suite 1064 Seattle, WA

3 Hypertext Transfer Protocol (HTTP) Peach Pit: HTTP Direction: Client, Server Supported Platforms: Windows, Linux, OS X Hypertext Transfer Protocol (HTTP) Specifications Specification RFC 1945 RFC 2616 Title Hypertext Transfer Protocol HTTP/1.0 Hypertext Transfer Protocol HTTP/1.1 Use Cases Messages Content Length Encoding Specification RFC1945 Chunked Transfer Encoding RFC 2616 Configuration Target Configuration There are two types of use for this pit: fuzzing a server and fuzzing a client. The default test fuzzes a server and the FuzzClient test fuzzes a client. Note that this pit will fuzz the HTTP protocol itself and is not meant to fuzz web applications. Required Pit Configuration Changes To Fuzz a Server TargetIPv4 IP address of the target host machine. TargetPort port number of the target HTTP server. HostHeader The HTTP Host header provided during an HTTP request. Should match DNS hostname used to access resources. 2

4 Required Pit Configuration Changes To Fuzz a Server SourcePort Port number to listen on for requests. Defaults to 80. Optional Pit Configuration Changes Strategy Fuzzing strategy Peach will use for testing. LoggerPath Path to folder where logs will be stored. PitLibraryPath Path to the relative base directory where all pits are located. Timeout How long to wait in milliseconds for incoming data. SendTimeout How long to wait in milliseconds when sending data. AcceptTimeout How long to wait in milliseconds for incoming connections to arrive. ConnectTimeout How long to wait in milliseconds for outgoing connections to complete. Configure Monitoring Monitoring must be configured to provide fault detection, data collection, and automation as needed. Running Single test debug run Listing 1. Fuzzing an HTTP Server peach -1 --debug HTTP_Server.xml -DTargetIPv4= DTargetPort=80 Listing 2. Fuzzing an HTTP Client peach -1 --debug HTTP_Client.xml -DSourcePort=80 3

5 Full test run Listing 3. Fuzzing an HTTP Server peach HTTP_Server.xml -DTargetIPv4= DTargetPort=80 Listing 4. Fuzzing an HTTP Client peach HTTP_Client.xml -DSourcePort=80 Examples 4

6 Example 1. Sample HTTP Client Configuration File Example configuration, note this does not show the agent configuration required to launch the target. <?xml version="1.0" encoding="utf-8"?> <PitDefines> <All> <Range key="sourceport" value="80" min="0" max="65535" name="target Port" description="the target or destination port the network packet is sent to."/> <String key="loggerpath" value="logs/http_client/" name="logger Path" description="the directory where Peach will save the log produced when fuzzing." /> <Strategy key="strategy" value="random" name="mutation Strategy" description="the mutation strategy to use when fuzzing." /> <String key="pitlibrarypath" value="." name="pit Library Path" description="the path to the root of the pit library."/> </All> </PitDefines> Example 2. Sample HTTP Server Configuration File An HTTP server must be configured on port 80. 5

7 <?xml version="1.0" encoding="utf-8"?> <PitDefines> <All> <Ipv4 key="targetipv4" value=" " name="target IPv4 Address" description="the IPv4 address of the target machine or device. The IPv4 address can be found on Windows by running 'ipconfig' and looking for the 'IPv4 Address' field. For Linux run 'ifconfig' and look for 'inet addr' field. For OS X run 'ifconfig' and look for the 'inet' field." /> <Range key="targetport" value="80" min="0" max="65535" name="target Port" description="the target or destination port the network packet is sent to."/> <String key="hostheader" value="peachfuzzer.com" name="http Host Header" description="host header, hostname or IP address. This is used by web servers to perform virtual hosting."/> <String key="loggerpath" value="logs/http_server/" name="logger Path" description="the directory where Peach will save the log produced when fuzzing." /> <Strategy key="strategy" value="random" name="mutation Strategy" description="the mutation strategy to use when fuzzing." /> <String key="pitlibrarypath" value="." name="pit Library Path" description="the path to the root of the pit library."/> </All> </PitDefines> 6