Python is an excellent scripting language that can be used to effectively develop custom fuzzing utilities. When assessing TCP services, the socket function can be useful in simplifying the process of performing the full three-way handshake sequence and connecting to a listening service port. The main objective of any fuzzing script is to send data to any given function as input and evaluate the result:
- I have developed a script that can be used to fuzz the post-authentication functions of an FTP service:
#!/usr/bin/python import socket import sys if len(sys.argv) != 6: print "Usage - ./ftp_fuzz.py [Target-IP] [Port Number] [Payload] [Interval] [Maximum]" print "Example - ./ftp_fuzz.py 10.0.0.5 21 A 100 1000" print "Example ...
