IEFuzz - A Static Internet Explorer Fuzzer

Today I'm sharing an IE Fuzzer, which was developed almost from scratch. Like many other softwares, browsers can also be fuzzed in two ways, a) Static and b) Dynamic.

Dynamic browser fuzzers are very popular, due to its speed, since they are purely written in JavaScript. However one common problem software security auditors face, while fuzzing browser dynamically, is 'Crash Reproduction'. You have to very careful while crafting your JS browser fuzzer (by placing logging code in right place), otherwise crash will not be reproducible.

Another option is, Static fuzzer. If you are fuzzing browsers using Static Test Cases, in 99% cases 'A crash' == 'A reproducible crash'.

How does 'IEFuzz' work?

  1. Launch IE
  2. Attach 'iexplore.exe' to debugger(pydbg) - To monitor any type of crash(Both in parent and child process).
  3. Generate a test case (html + javascript).
  4. Load the test case locally as file (file://c:/fuzzer/testcases/temp.html)in IE using win32COM.
  5. If no crash, re-generate a html test case and reload the test case using win32COM.(Note, we are not closing, re-opening IE here, We are just refreshing the same page but code/content of the page is different in every time. Which saves time significantly )
  6. In case of any kind of access violation, copy/save the test case to separate folder,  and kill IE completely.
  7. Go to step 1

This Static IE fuzzer is written in python. And following modules were used.

  1. pywin32com - Load / Reload *.html Test Cases
  2. pydbg - Monitor IE for Access Violation / Guard Page Violation.
  3. paimei - For crash dump generation.

Required Configuration Changes in IE

To run this Fuzzer you have to make following changes in IE: 

1. Since this fuzzer loads the test cases locally (eg. file://c:/fuzzer/testcases/temp.html) as .html file.
You must turn off IE's ActiveX warning prompt by following below instructions.

Tools (menu) -> Internet Options -> Security (tab) -> Custom Level (button) -> Disable Automatic prompting for ActiveX controls.

2. You also need to disable IE protected mode to be able to control Internet Explorer using Python 'win32com'. Please be aware of the risks.

 -> Internet Options -> Security -> Trusted Sites    : Low
 -> Internet Options -> Security -> Internet         : Medium + unchecked Enable Protected Mode
 -> Internet Options -> Security -> Restricted Sites : unchecked Enable Protected Mode

Writing Test Cases:

You can write you own static test case generator for this fuzzer in python. You have to place it inside /TestCases folder. For your reference one sample is given here 'TestCases/SampleTestCase.py'. While writing test cases do remember, it should have a 'TestCase' class and 'getFinalTestCase()' method in it. This getFinalTestCase() method should return the entire html page. 

In case of dynamic fuzzer, attributes of different html elements extracted from object and fuzzed on the fly at runtime , since its a static fuzzer we can pre define html elements and their attributes our test case as python dict.

attr = {'CANVAS':['height','width','getContext', ... , ... , ... ]}

For this attribute list generation, one JavaScript application is provided here : MiscTools/Generate_Elements_Dict.html

Source Code:

Source code of IEFuzz is available for download @ my github page.

Licence:

This software is licenced under BEER WARE licence although the following libraries are included with 'IEFuzz' and are licensed separately.

Running This Fuzzer:


One video demo is available here, on how to run this fuzzer and reproduce crashes.



Happy Fuzzing :) :)

Comments

  1. definately enjoy every little bit of it and I have you bookmarked to check out new stuff of your blog a must read blog! Speed Test Etisalat

    ReplyDelete
  2. Thank you for excellent article.Great information for new guy like antimalware service executable

    ReplyDelete
  3. Utilizing any of the above strategies won't just get your site punished in search rankings, it will more than likely get your site restricted from web indexes through and through. small business website seo services

    ReplyDelete
  4. Google figures that if many individuals are visiting your site and investing energy in it then your site must have significant or intriguing data on it and they will rank your site in like manner.
    We are very happy with backlinks from marketing1on1

    ReplyDelete
  5. Satellite broadband access makes use of two way communications between a subscriber and the satellite itself to deliver the Internet at broadband speeds. Unlimited wireless internet provider

    ReplyDelete
  6. seaport hack Excellent trick this great friend, this was what I was looking for a long time and finally something that works. I recommend them all if it is real is not a lie. Thanks friend. Keep it up

    ReplyDelete
  7. Glad to chat your blog, I seem to be forward to more reliable articles and I think we all wish to thank so many good articles, blog to share with us. power lead system

    ReplyDelete
  8. We are the famous company of Movers and packers Dubai and packers and movers Dubai because we always take care of customer satisfaction and needs. We are the licensed and accredited moving company that provides all kinds of relocation services with grab discounts. We have well and educated teams who can work with honest and safely and securely. They don’t any hidden charges or bad behavior to their customers. Customer satisfaction and happiness are very important things.
    Packers and movers Dubai
    Movers and packers Dubai
    Packers movers Dubai
    Dubai movers packers

    ReplyDelete
  9. RC MOVERS PACKERS is famous for Home movers Dubai and Office movers Dubai that can provide comprehensive solutions for residential and commercial relocation services in your areas. We have top-level staff who are very talented and very honest in house movers Dubai and office movers Dubai fields. They provide a complete solution for all kinds of relocation services in your locality. So if you need a house, office, and villa movers service.

    ReplyDelete
  10. SAVE YOUR HOME is the well-trained company of Ac repair service in Dubai that can give you stressed out service in your locality. We have educated teams who can repair all types of Air conditioning repair unit like Central air conditioning, Window air conditioning, Portable air conditioning, geothermal air conditioning, Split air conditioning and chiller plants. We have many over 10 years of experience in air conditioning repair and installation and maintenance. Call us.
    Ac repair and service
    Air conditioning service and maintenance Dubai
    Ac repair service Dubai

    ReplyDelete
  11. The procedure is automated so you don't have to actively seek contact information ongoing to create a gigantic database. best internet provider toronto

    ReplyDelete
  12. Google offers advertisements which appear in search results on google.com with the use of Google AdWords or advertisements that
    appear on other websites through the Display Network and Google’s AdSense program.
    With google ads you can appear in the top for searched keywords.Thus you will receive more relevant customers for your business.
    Google Ads Services
    You can get Apple-certified repairs and service at the Apple Store or with one of our Apple Authorized Service Providers.
    mobile phone repair in North Olmsted

    ReplyDelete
  13. Eagle Technical services is a highly professional company all over Dubai. we can provide you the best service at a lower cost for a House wall painting service, Wall painting service, Interior wall painter, and Wall painting Dubai service. Do you want good service? call me today and get great services.

    ReplyDelete
  14. This comment has been removed by the author.

    ReplyDelete
  15. Do you need Samsung LED TV repair Dubai service? We have the best teams for Samsung LED TV repair service who can offer you quality service. Just contact us.

    ReplyDelete
  16. 다음에 블로그를 읽을 때 이것만큼 실망하지 않았 으면 좋겠다. 제 말은 제가 읽기로 선택한 것이지만 사실 당신이 할 말이있는 것 같았어요. 내가 듣는 모든 것은 당신이 관심을 얻기 위해 너무 바쁘지 않았다면 고칠 수있는 것에 대해 징징 거리는 것입니다. 먹튀검증사이트

    ReplyDelete
  17. They can be tips related to numerous composition categories, including college applications and complex assignments like Kaplan assignment help 먹튀검증

    ReplyDelete
  18. You have done a amazing job with you website braces in tijuana

    ReplyDelete
  19. Thanks for your marvelous posting! I actually enjoyed reading it, you could be
    a great author.I will remember to bookmark your blog and will
    eventually come back from now on. I want to encourage you to토토

    continue your great
    writing, have a nice weekend!

    ReplyDelete
  20. 와우, 내가 찾은 훌륭한 게시물 먹튀검증

    ReplyDelete
  21. Thanks for valuable posts that encourage us to come on your site. I know it takes huge patience and dedication to craft such informative articles. Anyway, I have written a informative post to someone who is interested in knowing about Bihar Sharif Pin Code
    .

    ReplyDelete
  22. The induction hob is used in the kitchen to prepare food for the family friend and customer etc. If you induction hob repair dubai, Ceramic hob repair sharjah and Ceramic repair dubai is not working properly contact us.

    ReplyDelete
  23. These cards are taking over New York
    tko carts
    whats your take??

    ReplyDelete
  24. BUDGET CITY MOVERS is one of the most popular companies in Dubai. We can provide you well trained and capable moving teams for Movers in Dubai, Movers and Packers Dubai, Dubai movers and packers, Dubai movers, Packers and movers Dubai, and House movers in Dubai. For any requirement just connect with us to get the effective packers movers service in your budget as well as in your locality. call us: 055 6254 802

    ReplyDelete
  25. Most providers of CCTV maintenance Dubai but LOGICAL NETWORK SOLUTION offers the impeccable service their client a CCTV maintenance Dubai. We are the most famous CCTV installation Dubai that offers a cost-effective service of CCTV Camera Installation Dubai. We do the replacement, maintenance, and installation on a low budget.

    ReplyDelete
  26. Look at DECO WOOD DECORATION for Luxury Interior Design Dubai and get change the design at a future date. We are the best choice for luxury interior design services that make it less costly that may provide you with the interior design of your dreams.

    ReplyDelete
  27. Do you remember when you rode a bicycle with no hands for the first time? "Look Mom! No hands!" Ahhh..free as a bird. Good old days, right? Computer users can relate to that same experience when using wireless for the first time and every time. 10.0.0.0.1

    ReplyDelete
  28. Your explanation is organized very easy to understand!!! I understood at once. Could you please post about 바카라사이트?? Please!!

    ReplyDelete
  29. Tawdeeh Technical Services best possible service of Video Intercom System Dubai, Audio video intercom system Dubai. A video intercom system is the more portable that can be placed anywhere in the house and installed in a wall in the room to communicate back with someone. So a video or audio intercom system is an excellent choice for your family. To installed just visit our website and for more information.

    ReplyDelete
  30. We are the most experienced company in Dubai for TV repair services Dubai that offer the comfort level service on your own home. We are a well-trained TV repair Dubai Company that provides you responsive, timely, and professional service.

    ReplyDelete
  31. Fastpaintersdubai is the best painting company Dubai that has professional painters Dubai that offer complete responsibility and satisfaction. We are the trusted painting services UAE that also provides guaranteed and insurance of the work time.

    ReplyDelete
  32. We are the reliable Sony TV repair Dubai Company that offers great customer service. We have selective engineers who offer you quality services for Sony models. On the other hand, they have sufficient knowledge who can explain all the problems in free estimates quotes.

    ReplyDelete
  33. if you are looking for interior renovation services in dubai then you came to the right place. We provide the best interior renovation services
    in dubai at very affordable cost, to make use of our services just give us a call or contact us through our website.Best interior renovation company Dubai

    ReplyDelete
  34. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post. 토토사이트

    ReplyDelete
  35. Hi buddies, it is great written piece entirely defined, continue the good work constantl 토토사이트

    ReplyDelete
  36. Excellent information on your blog, thank you for taking the time to share with us. Amazing insight you have on this, it's nice to find a website that details so much information about different artists. 안전놀이터

    ReplyDelete
  37. I think this is a sublime article, and the content published is fantastic. This content will help me to complete a paper that I've been working on for the last 2 weeks. It was a difficult 2 weeks, but I am glad the work is done now. 안전놀이터

    ReplyDelete
  38. Excellent and very exciting site. Love to watch. Keep Rocking. 메이저놀이터

    ReplyDelete
  39. I really appreciate the kind of topics you post here. Thanks for sharing  information that is actually helpful. Good day! Want to know the steps to resolve 먹튀검증업체

    ReplyDelete
  40. Interesting post. I Have Been wondering about this issue. so thanks for posting. Pretty cool post.It 's really very nice and Useful post.Thanks 먹튀폴리스

    ReplyDelete
  41. The most interesting text on this interesting topic that can be found on the net ... 먹튀검증커뮤니티

    ReplyDelete
  42. I think this is a sublime article, and the content published is fantastic. This content will help me to complete a paper that I've been working on for the last 2 weeks. It was a difficult 2 weeks, but I am glad the work is done now. 토토사이트

    ReplyDelete
  43. definately enjoy every little bit of it and I have you bookmarked to check out new stuff of your blog a must read blog! 토토사이트

    ReplyDelete
  44. Thanks for sharing such information with us due to which my several concepts have been cleared.  안전놀이터

    ReplyDelete
  45. Thanks for sharing! I din’t knew all of them but i liked some changes such as option for different views  메이저놀이터

    ReplyDelete
  46. On my website you'll see similar texts, write what you think. 안전놀이터

    ReplyDelete
  47. Gives you the best website address I know there alone you'll find how easy it is. 메이저놀이터

    ReplyDelete
  48. Gives you the best website address I know there alone you'll find how easy it is. 토토사이트

    ReplyDelete
  49. It is somewhat fantastic, and yet check out the advice at this treat. 먹튀검증

    ReplyDelete
  50. What a fantabulous post this has been. Never seen this kind of useful post. I am grateful to you and expect more number of posts like these. Thank you very much 먹튀검증커뮤니티

    ReplyDelete
  51. After research a couple of of the weblog posts in your website now, and I really like your method of blogging. I bookmarked it to my bookmark website record and will probably be checking back soon. Pls check out my site as effectively and let me know what you think. Computers & Accessories 먹튀검증업체

    ReplyDelete
  52. A debt of gratitude is in order for giving late reports with respect to the worry, I anticipate read more. 먹튀폴리스

    ReplyDelete
  53. I haven’t any word to appreciate this post.....Really i am impressed from this post....the person who create this post it was a great human..thanks for shared this with us Web Design Essex

    ReplyDelete
  54. I was recommended this blog by my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my difficulty. You’re wonderful! Thanks! 먹튀검증

    ReplyDelete
  55. Thanks for your nice post I really like it and appreciate it. My work is about Vape Packaging Solution. If you need perfect quality boxes then you can visit our website.

    ReplyDelete
  56. I've been searching for hours on this topic and finally found your post. , I have read your post and I am very impressed. We prefer your opinion and will visit this site frequently to refer to your opinion. When would you like to visit my site? 토토커뮤니티

    ReplyDelete
  57. We can repair your non-working Siemens washing machine easily in Dubai our company has years of experience in this field of repairing. To know more about our service, just contact us through our website.
    Siemens Washing Machine Repair Dubai

    ReplyDelete
  58. I gotta favorite this website it seems very helpful  먹튀폴리스

    ReplyDelete
  59. i read your article its good for humanity thanks for sharing this its very informative 먹튀폴리스

    ReplyDelete
  60. The assignment submission period was over and I was nervous, 토토사이트 and I am very happy to see your post just in time and it was a great help. Thank you ! Leave your blog address below. Please visit me anytime.

    ReplyDelete
  61. Unbelievable!! The problem I was thinking about was solved.카지노사이트You are really awesome.

    ReplyDelete
  62. That's a great article! The neatly organized content is good to see. Can I quote a blog and write it on my blog? My blog has a variety of communities including these articles. Would you like to visit me later? 온라인홀덤

    ReplyDelete
  63. If you live in a Dubai larger city, then must you need Handyman services in Dubai that do quality work and deliver optimum service in your home? Save Your Home have many employees handyman who can make the job easier than starting a lot of stress. You can deal with our Handyman Dubai and get stressed out in each and every kind of work.

    ReplyDelete
  64. It's very interesting. And it's fun. This is a timeless article. I also write articles related to , and I run a community related to 안전놀이터. For more information, please feel free to visit !!

    ReplyDelete
  65. I wanted to leave a little comment to support you and wish you a good continuation. 토토사이트 Wishing you the best of luck for all your blogging efforts.

    ReplyDelete
  66. I accidentally searched and visited your site. I still saw several posts during my visit, but the text was neat and readable. I will quote this post and post it on my blog. Would you like to visit my blog later? 우리카지노

    ReplyDelete
  67. Thank you and thank you so much. I'll share you useful information.토토사이트

    ReplyDelete
  68. PAINTING SERVICE UAE is the leading and professional company of Painting services Dubai. We have over 5 years of experience in painting services, wall painting services, villa painting services, house painting services, office painting services, apartment painting services, and many others. We have thousands of painters in Dubai teams who are very trained and knowledgeable about any painting services. We give a free estimate as to how much will it cost to get the job done at fair prices.

    ReplyDelete
  69. Get Nalanda News on Biharsharifnalanda. We bring latest update of Nalanda District including Biharsharif, Hilsa, Nalanda, Rajgir, Islampur, Asthawan and Harnaut into public domain by publishing authentic news and updated information.

    ReplyDelete
  70. I've been looking for photos and articles on this topic over the past few days due to a school assignment, 먹튀검증 and I'm really happy to find a post with the material I was looking for! I bookmark and will come often! Thanks :D

    ReplyDelete
  71. https://designingcourses.in/
    Very Informative and useful... Keep it up the great work. I really appreciate your post.

    https://designingcourses.in/graphic-designing-courses-in-bangalore/
    https://designingcourses.in/web-designing-course-in-bangalore/

    ReplyDelete
  72. MSIT Solutions is a top Digital Marketing Company in India
    in India with a corporate office in Bihar. We are committed to offer world-class ethical digital services with professional approach.

    ReplyDelete
  73. Unbelievable!! The problem I was thinking about was solved.카지노사이트You are really awesome.

    ReplyDelete
  74. Thank you and thank you so much. I'll share you useful information.토토사이트

    ReplyDelete
  75. I've been looking for photos and articles on this topic over the past few days due to a school assignment, 먹튀검증 and I'm really happy to find a post with the material I was looking for! I bookmark and will come often! Thanks :D

    ReplyDelete
  76. I need you to thank for your season of this awesome 먹튀검증!!! I definately appreciate each and every piece of it and I have you bookmarked to look at new stuff of your blog an absolute necessity read blog!!!!

    ReplyDelete
  77. I am overwhelmed by your post with such a nice topic. Usually I visit your 안전놀이터 and get updated through the information you include but today’s blog would be the most appreciable. Well done!

    ReplyDelete
  78. There must have been many difficulties in providing this information.메이저토토사이트 Nevertheless, thank you for providing such high-quality information.

    ReplyDelete
  79. What a nice comment!Nice to meet you. I live in a different country from you. Your writing will be of great help to me and to many other people living in our country. I was looking for a post like this, but I finally found 토토사이트.

    ReplyDelete
  80. Hello! Nice to meet you, I say . The name of the community I run is 안전놀이터, and the community I run contains articles similar to your blog. If you have time, I would be very grateful if you visit my site .

    ReplyDelete
  81. Hello
    Thank you for giving me useful information.
    Please keep posting good information in the future
    I will visit you often. 토토사이트Thank you.
    I am also running the site. 메이저놀이터 This is a related site, so please visit once.안전놀이터
    Have a niceday!

    ReplyDelete
  82. Hahaha, good, good. The writing is interesting.토토사이트 Look at my writing.

    ReplyDelete
  83. Of course, your article is good enough, but I thought it would be much better to see professional photos and videos together. There are articles and photos on these topics on my homepage, so please visit and share your opinions. 토토커뮤니티

    ReplyDelete
  84. Looking at this article, I miss the time when I didn't wear a mask. 먹튀검증 Hopefully this corona will end soon. My blog is a blog that mainly posts pictures of daily life before Corona and landscapes at that time. If you want to remember that time again, please visit us.

    ReplyDelete
  85. If you're still wondering whether you need CCTV Camera installation in Dubai or any other the answer is yes. Smart Bio Time provides you the proper installation of a CCTV System. Get rapid response to your request shows commitment and value for your needs.

    ReplyDelete
  86. Your site is my favourite site because it made my job easier.If you want to see my work,follow my site customized packaging custom boxes
    which is just like yours

    ReplyDelete
  87. Looking for reputable and respectable Carpentry services dubai that offers great carpentry jobs. Homemaintenancedubai has experienced handling any major or minor carpentry work on your own house. Getting the right custom carpentry service for your needs.

    ReplyDelete
  88. Are you facing any problems in your fridge, then no problem we are here to fix your fridge at affordable cost. We have a lot experienced technicians in company who are really very laborious through their work , then what are waiting for just contact us through our website to take our service and also you can contact us with number which we provided on our Website.
    Fridge repair in Dubai marina

    ReplyDelete
  89. Hello! I could have sworn I've been to this site before but after checking through some of the post I realized it's new to me. Nonetheless, I'm definitely happy I found 메이저놀이터 and I'll be book-marking and checking back frequently!

    ReplyDelete
  90. I need you to thank for your season of this awesome 먹튀검증!!! I definately appreciate each and every piece of it and I have you bookmarked to look at new stuff of your blog an absolute necessity read blog!!!!

    ReplyDelete
  91. I am overwhelmed by your post with such a nice topic. Usually I visit your 안전놀이터 and get updated through the information you include but today’s blog would be the most appreciable. Well done!

    ReplyDelete
  92. First of all, thank you for your post. Your posts are neatly organized with the information I want, so there are plenty of resources to reference. I bookmark this site and will find your posts frequently in the future. Thanks again ^^ 바둑이사이트

    ReplyDelete
  93. That's a really good piece of writing. It's been a lot of help. I'll help you.토토사이트

    ReplyDelete
  94. Choose Dubai Electrical Plumber for Water Heater Repair Company Dubai that is qualified, trained, and licensed. Get comfortable service for water heater repair dubai or water heater services dubai at a very low budget as well as in no time

    ReplyDelete
  95. Choosing the Creative Sky LLC for Ac maintenance Dubai and get the best value for their money. So if you are looking for the best Ac maintenance company in Dubai then it would be better that select Creative Sky LLC.

    ReplyDelete
  96. I'm writing on this topic these days, 먹튀검증, but I have stopped writing because there is no reference material. Then I accidentally found your article. I can refer to a variety of materials, so I think the work I was preparing will work! Thank you for your efforts.

    ReplyDelete
  97. Hello ! I am the one who writes posts on these topics 메이저토토사이트 I would like to write an article based on your article. When can I ask for a review?!

    ReplyDelete
  98. As I am looking at your writing, 온라인바둑이 I regret being unable to do outdoor activities due to Corona 19, and I miss my old daily life. If you also miss the daily life of those days, would you please visit my site once? My site is a site where I post about photos and daily life when I was free.

    ReplyDelete
  99. There are various companies that offer Movers and Packers in Dubai service, but Fs-Services is the experienced movers in Dubai that have a perfect understanding of the right size of boxes, packing material, transportation requirements, and all other aspects of things. At FS-Services Movers and Packers, the teams of experts stand up to your requirement at all times with the utmost care.

    ReplyDelete
  100. Thank you for any other informative blog. Where else may just I am getting that kind of information written in such a perfect method? I have a mission that I’m simply now working on, and I have been on the glance out for such info. 먹튀검증

    ReplyDelete
  101. That's a really good piece of writing. It's been a lot of help. I'll help you.토토사이트

    ReplyDelete
  102. This site seems to inspire me a lot. Thank you so much for organizing and providing this quality information in an easy to understand way. 먹튀검증사이트 I think that a healthy era of big data can be maintained only when such high-quality information is continuously produced. And I, too, are working hard to organize and provide such high-quality information. It would be nice to come in once and get information. 먹튀검증

    ReplyDelete
  103. This is one very interesting post. I like the way you write and I will bookmark your blog to my favorites. 메이저토토사이트

    ReplyDelete
  104. The article composing business is going extraordinary for me at this moment, and the vast majority of my prosperity is because of the substance that you post here. I utilize your substance to compose my articles, and the substance makes my great article incredible. 온라인포커

    ReplyDelete

Post a Comment