(calm music)
- [Instructor] In this lesson
I'm going to show you how to use AFL.
Now AFL stands for American Fuzzy Lop
and is one of the top fuzzers,
if not the best fuzzer at the moment.
And it uses genetic algorithms
just like we discussed earlier.
To install it, it's pretty easy.
You just open up your terminal
and use a package manager.
Now I have on my desktop a target program.
It's relatively simple C program
that has a well-known vulnerability.
What it does is take in your username
and your password, check if the username is admin,
if it is, it will also check your password against
this sequence of letters and numbers.
And if it is equal to that, then you'll get access.
Otherwise, your access will be denied.
So I'm going to fuzz it using AFL.
The way AFL works, we'll use AFL
to compile this program,
which allows to inject AFL's code
and then instrument the program
and monitor and see what's going on.
So let's see how this works.
I'm going to go to the directory of my target
and I'm going to use afl-clang-fast as my compiler.
Then input the source code,
output the name of the result.
And the reason I'm using afl-clang-fast is that it will make
the fuzzing much, much faster.
There's other options like afl and gcc,
afl-clang without the fast and so on.
Running this resulted in a successful compilation.
It does mention that there is a vulnerability
or at least a potential vulnerability in the program,
which is correct.
It does have a vulnerability. And that's the gets.
Next thing we want to do is create a directory
that'll contain our test cases,
our seeds or initial population if you'd like.
So my inputs are going to look like so.
Maybe admin, and then the correct password.
That'd be one possible input.
Another possible input would be
just some random username, still correct password.
Maybe another input would be both are wrong.
Some random username, random password.
And I can keep seeding like this.
Depending on my application,
might use some other seeds,
but that's enough to get us started.
Next, I'm ready to run AFL,
but it won't work the first time
and you'll see why, there's a little error
that's not too hard to fix.
So I do afl-fuzz.
Input is in. So that's the test cases or seeds if you like.
Dev set up.
- O will be the directory that has outputs.
It's going to have the crashes,
meaning the inputs that cause crashes
and some additional information.
And then the binary we are going to attack.
Like I said, it won't work straight away. And here's why.
'Cause my system is configured
to send core dump notifications to an external utility
and this will cause a delay,
but fixing it is pretty easy,
so I'm just going to need to run this as a root user.
And now we are ready to fuzz.
And this is the famous AFL interface for while it's fuzzing.
So we can see here how long it's been running.
Last new path, unique crash,
hangs, total paths,
cycles, unique crashes, hangs,
different types of mutations that it's executing,
bit flips.
In addition, when running AFL, you have the option
to limit memory once you feel satisfied.
And I am feeling satisfied
because we found a lot of crashes.
Most of them are of the same type, but four are unique.
Then you can just control c and end the fuzzing.
So now let's take a look at what it generated.
So this is the output folder.
And you can see there are stats and hangs and queues,
but most importantly the crashes,
which is what we are interested in.
And here it found four unique crashes.
We're not interested in the README, just the crashes.
And we can see what the crashes were like.
And if we'd like, we can pass them into our target.
So I'm going to run my program
and I'm going to feed it one of these crashes.
Let's say the first one.
And you can see we have a segmentation fault.
And that's of course due to the gets that's in there,
which is an unsafe function.
So this is how you use AFL on a simple program.
And the basic approach is no different
for more complicated programs.
You'll want to get the source, ideally.
There's also the option to work on a black box,
but source is much better.
You'll compile using the AFL versions
of the compiler you'd like to use.
You'll populate the initial folder of seeds
and then you fuzz away.
And you can do this on all sorts of programs.
You can do this on tcpdump by inputting odd packets.
You can do this on a gif to PNG converter
by seeding with all sorts of gifs.
You can do this on PDF readers
by seeding in all sorts of PDFs.
The sky is the limit when it comes to fuzzing.