Thursday, December 24, 2015

IEFuzz - A Static Internet Explorer Fuzzer

Today I'm sharing an IE Fuzzer, which was developed almost from scratch. Like many other softwares, browsers can also be fuzzed in two ways, a) Static and b) Dynamic.

Dynamic browser fuzzers are very popular, due to its speed, since they are purely written in JavaScript. However one common problem software security auditors face, while fuzzing browser dynamically, is 'Crash Reproduction'. You have to very careful while crafting your JS browser fuzzer (by placing logging code in right place), otherwise crash will not be reproducible.

Another option is, Static fuzzer. If you are fuzzing browsers using Static Test Cases, in 99% cases 'A crash' == 'A reproducible crash'.

How does 'IEFuzz' work?

  1. Launch IE
  2. Attach 'iexplore.exe' to debugger(pydbg) - To monitor any type of crash(Both in parent and child process).
  3. Generate a test case (html + javascript).
  4. Load the test case locally as file (file://c:/fuzzer/testcases/temp.html)in IE using win32COM.
  5. If no crash, re-generate a html test case and reload the test case using win32COM.(Note, we are not closing, re-opening IE here, We are just refreshing the same page but code/content of the page is different in every time. Which saves time significantly )
  6. In case of any kind of access violation, copy/save the test case to separate folder,  and kill IE completely.
  7. Go to step 1

This Static IE fuzzer is written in python. And following modules were used.

  1. pywin32com - Load / Reload *.html Test Cases
  2. pydbg - Monitor IE for Access Violation / Guard Page Violation.
  3. paimei - For crash dump generation.

Required Configuration Changes in IE

To run this Fuzzer you have to make following changes in IE: 

1. Since this fuzzer loads the test cases locally (eg. file://c:/fuzzer/testcases/temp.html) as .html file.
You must turn off IE's ActiveX warning prompt by following below instructions.

Tools (menu) -> Internet Options -> Security (tab) -> Custom Level (button) -> Disable Automatic prompting for ActiveX controls.

2. You also need to disable IE protected mode to be able to control Internet Explorer using Python 'win32com'. Please be aware of the risks.

 -> Internet Options -> Security -> Trusted Sites    : Low
 -> Internet Options -> Security -> Internet         : Medium + unchecked Enable Protected Mode
 -> Internet Options -> Security -> Restricted Sites : unchecked Enable Protected Mode

Writing Test Cases:

You can write you own static test case generator for this fuzzer in python. You have to place it inside /TestCases folder. For your reference one sample is given here 'TestCases/SampleTestCase.py'. While writing test cases do remember, it should have a 'TestCase' class and 'getFinalTestCase()' method in it. This getFinalTestCase() method should return the entire html page. 

In case of dynamic fuzzer, attributes of different html elements extracted from object and fuzzed on the fly at runtime , since its a static fuzzer we can pre define html elements and their attributes our test case as python dict.

attr = {'CANVAS':['height','width','getContext', ... , ... , ... ]}

For this attribute list generation, one JavaScript application is provided here : MiscTools/Generate_Elements_Dict.html

Source Code:

Source code of IEFuzz is available for download @ my github page.

Licence:

This software is licenced under BEER WARE licence although the following libraries are included with 'IEFuzz' and are licensed separately.

Running This Fuzzer:


One video demo is available here, on how to run this fuzzer and reproduce crashes.



Happy Fuzzing :) :)

17 comments:

  1. definately enjoy every little bit of it and I have you bookmarked to check out new stuff of your blog a must read blog! Speed Test Etisalat

    ReplyDelete
  2. Thank you for excellent article.Great information for new guy like antimalware service executable

    ReplyDelete
  3. Utilizing any of the above strategies won't just get your site punished in search rankings, it will more than likely get your site restricted from web indexes through and through. small business website seo services

    ReplyDelete
  4. Google figures that if many individuals are visiting your site and investing energy in it then your site must have significant or intriguing data on it and they will rank your site in like manner.
    We are very happy with backlinks from marketing1on1

    ReplyDelete
  5. Satellite broadband access makes use of two way communications between a subscriber and the satellite itself to deliver the Internet at broadband speeds. Unlimited wireless internet provider

    ReplyDelete
  6. seaport hack Excellent trick this great friend, this was what I was looking for a long time and finally something that works. I recommend them all if it is real is not a lie. Thanks friend. Keep it up

    ReplyDelete
  7. Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. power lead system

    ReplyDelete
  8. We are the famous company of Movers and packers Dubai and packers and movers Dubai because we always take care of customer satisfaction and needs. We are the licensed and accredited moving company that provides all kinds of relocation services with grab discounts. We have well and educated teams who can work with honest and safely and securely. They don’t any hidden charges or bad behavior to their customers. Customer satisfaction and happiness are very important things.
    Packers and movers Dubai
    Movers and packers Dubai
    Packers movers Dubai
    Dubai movers packers

    ReplyDelete
  9. RC MOVERS PACKERS is famous for Home movers Dubai and Office movers Dubai that can provide comprehensive solutions for residential and commercial relocation services in your areas. We have top-level staff who are very talented and very honest in house movers Dubai and office movers Dubai fields. They provide a complete solution for all kinds of relocation services in your locality. So if you need a house, office, and villa movers service.

    ReplyDelete
  10. SAVE YOUR HOME is the well-trained company of Ac repair service in Dubai that can give you stressed out service in your locality. We have educated teams who can repair all types of Air conditioning repair unit like Central air conditioning, Window air conditioning, Portable air conditioning, geothermal air conditioning, Split air conditioning and chiller plants. We have many over 10 years of experience in air conditioning repair and installation and maintenance. Call us.
    Ac repair and service
    Air conditioning service and maintenance Dubai
    Ac repair service Dubai

    ReplyDelete