Question Around Response Port

[ninp0]

I'm fuzzing a service that communicates over two TCP ports - one for requests and one for responses. For example, I send a request to TCP 999 and would receive its respective response over TCP 1999 (TCP 999 returns nothing). Is there an elegant way boofuzz can take this communication use-case into account in order to avoid aborting fuzzing? Please let me know at your earliest convenience. Thanks in advance!

[jtpereyda]

In order to simply avoid failing, you could set check_data_received_each_request to False (see the Session docs).

However, to actually receive the data over the second port and do something with it would be different. There is nothing like this built in, but you might be able to get by using (overriding) the post_send method. You could make a custom connection object used only within the post_send method. You would call recv manually within post send to see if anything was returned.

If you try this out, let us know how it goes!

[ninp0]

I'm sure there's a better way to do this but here's what I came up with:

def get_resp(target, fuzz_data_logger, session, sock, *args, **kwargs):
  last_resp_bytes = ''
  resp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

  try:
    resp_socket.bind(('0.0.0.0', response_port))
    resp_socket.listen(1)
    conn, addr = resp_socket.accept()

    print('Connection from: ' + str(addr))
    while True:
      resp = str(conn.recv(1024).decode())
      if not resp:
        break

      full_resp = last_resp_bytes + resp

  except:
    print 'resp_socket initialization failed'
  finally:
    resp_socket.close
    fuzz_data_logger.log_recv(full_resp)

    test_case_desc = (
      'Fuzz Session ARGS: ' + ' '.join(sys.argv[1:])
    )

    # Example Condition that is known to result in failure
    if 'SOME STRING' in full_resp:
      failure_reason_desc = (
        test_case_desc +
        ', REASON: SOME STRING results in failure'
      )
      fuzz_data_logger.log_fail(failure_reason_desc)
    else:
      fuzz_data_logger.log_pass(test_case_desc)

response_port = 1999
session = Session(
  post_test_case_callbacks = [get_resp],
  check_data_received_each_request=True,
  target = Target(
    connection = SocketConnection(target, port)
  )
)

[SR4ven]

Thanks for sharing your solution @ninp0!