MCPcopy Create free account
hub / github.com/blacklanternsecurity/bbot / fuzz

Method fuzz

bbot/modules/lightfuzz/submodules/crypto.py:367–493  ·  view source on GitHub ↗
(self)

Source from the content-addressed store, hash-verified

365 return hash_functions[hash_length]
366
367 async def fuzz(self):
368 cookies = self.event.data.get("assigned_cookies", {})
369 probe_value = self.incoming_probe_value(populate_empty=False)
370
371 if not probe_value:
372 self.debug(
373 f"The Cryptography Probe Submodule requires original value, aborting [{self.event.data['type']}] [{self.event.data['name']}]"
374 )
375 return
376
377 # obtain the baseline probe to compare against
378 baseline_probe = await self.baseline_probe(cookies)
379 if not baseline_probe:
380 self.verbose(f"Couldn't get baseline_probe for url {self.event.data['url']}, aborting")
381 return
382
383 # perform the manipulation techniques
384 try:
385 truncate_probe_value = self.modify_string(probe_value, action="truncate")
386 mutate_probe_value = self.modify_string(probe_value, action="mutate")
387 except ValueError as e:
388 self.debug(f"Encountered error modifying value for parameter [{self.event.data['name']}]: {e} , aborting")
389 return
390
391 # Basic crypanalysis
392 likely_crypto, possible_block_cipher = self.cryptanalysis(probe_value)
393
394 # if the value is not likely to be cryptographic, we can skip the rest of the tests
395 if not likely_crypto:
396 self.debug("Parameter value does not appear to be cryptographic, aborting tests")
397 return
398
399 # Cryptographic Response Divergence Test
400
401 http_compare = self.compare_baseline(self.event.data["type"], probe_value, cookies)
402 try:
403 arbitrary_probe = await self.compare_probe(http_compare, self.event.data["type"], "AAAAAAA", cookies) #
404 truncate_probe = await self.compare_probe(
405 http_compare, self.event.data["type"], truncate_probe_value, cookies
406 ) # manipulate the value by truncating a byte
407 mutate_probe = await self.compare_probe(
408 http_compare, self.event.data["type"], mutate_probe_value, cookies
409 ) # manipulate the value by mutating a byte in place
410 except HttpCompareError as e:
411 self.verbose(f"Encountered HttpCompareError Sending Compare Probe: {e}")
412 return
413
414 confirmed_techniques = []
415 # mutate_probe[0] will be false if the response is different - mutate_probe[1] stores what aspect of the response is different (headers, body, code)
416 # ensure the difference is in the body and not the headers or code
417 # if the body is different and not empty, we have confirmed that single-byte mutation affected the response body
418 if mutate_probe[0] is False and "body" in mutate_probe[1]:
419 if (http_compare.compare_body(mutate_probe[3].text, arbitrary_probe[3].text) is False) or mutate_probe[
420 3
421 ].text == "":
422 confirmed_techniques.append("Single-byte Mutation")
423
424 # if the body is different and not empty, we have confirmed that byte truncation affected the response body

Callers

nothing calls this directly

Calls 15

modify_stringMethod · 0.95
cryptanalysisMethod · 0.95
error_string_searchMethod · 0.95
padding_oracleMethod · 0.95
incoming_probe_valueMethod · 0.80
baseline_probeMethod · 0.80
compare_baselineMethod · 0.80
compare_probeMethod · 0.80
compare_bodyMethod · 0.80
metadataMethod · 0.80

Tested by

no test coverage detected