bfuzz.sh

#!/bin/bash
# ./bfuzz.sh (basic bash fuzzer)
# Israel Torres hakin9@israeltorres.org
# Mon May 30 15:54:33 PDT 2011
# "from-fuzz-to-sploit"
# demo to:
# 1. fuzz a executable file using a pattern, sequence, interaction type
# executable pattern max_sequence type_of_interaction stop_on_err_#_of_x
#
# use in bash prompt:
# ./bfuzz.sh 'executable' 'pattern' 'maxseq' 'i|n' 'error#oftimes'
#
if [ ! $# -lt 5 ]; then
    testapp=$1
    tempvar=$2
    testmax=$3
    testype=$4
    testerr=$5
    testvar=$tempvar
    for ((i=1;i<=testmax;i++)); do
        if [ $testype == "i" ]; then
        rslt=$(echo $testvar | $testapp); lastrtn=$?
        fi
        if [ $testype == "n" ]; then
        rslt=$($testapp $testvar); lastrtn=$?
        fi
        echo -e "seq:\t$i\texec:$testapp\tlastrtn:$lastrtn"
        if [ $lastrtn -ne 0 ] ; then
            pwn=$(echo -n $testvar | xxd -p)
            echo -e "pwn:\t0x$pwn"
            echo -e "pwn:\t$testvar"
            errcnt=$((errcnt+1))
            if [ $testerr == $errcnt ]; then
            break;
            fi
        fi
        testvar="${testvar}$tempvar"
    done

else
    echo "usage: $0 'executable' 'pattern' 'maxseq' 'i|n' '#'"
    echo "example: $0 ./demo-vuln-64 A 50 i 5"
fi

#EOF