Category Security

ByteFUZZ

ByteFUZZ is a file format fuzzer that can do blind fuzzing, by replacing bytes from the original/seed file. Once the files are generated, it will call the target program with the fuzzed files as arguments and check to see if…

IDA script to create a memory dump

This is an IDA script that can do a memory dump. It’s useful to run it after you’ve gone past the obfuscation layer(s) and reached the decrypted code auto eax; auto start; auto end; auto f; f = fopen(“dump.bin”, “w”); start =…

Forensics with Volatility

Command Description $./volatility –filename=. –profile=WinXPSP2x86 psscan Check for hidden processes (would show as False in pslist or psscan) $./volatility –filename=. –profile=WinXPSP2x86 psxview Check for hidden processes (would show as False in pslist or psscan) $./volatility –filename=. –profile=WinXPSP2x86 envars -p 123…

Change swappiness in Ubuntu

Linux uses a swap partition, that represents the system’s virtual memory. The swappiness represents how often the system will copy stuff from RAM to disk/virtual memory. The more RAM you have, the less you need to copy to disk and…

Forensic artefacts extractor

This is a script developed in python to extract forensic artefacts from a file/memory dump. It’s useful to run it after you’ve gone past the obfuscation layer(s) and reached the decrypted code It can extract filenames, registry keys, urls, e-mail…

File format fuzzer (generic)

This script can generate fuzzing files with valid AVI/BMP/CUE/GIF/JPG/PDF/PNG headers. The body can be a constant set of characters or random characters (useful to determine the offset when the program crashes). The code is available on github. You can download…

Fuzzing FTP server commands

This script can be used to do fuzzing against an FTP server. It supports the following commands: ABOR ACCT ALLO APPE CWD DELE DIR FORM GET HELP LIST MACDEF MDELETE MDIR MGET MKD MLS MODE MODETIME MPUT NEWER NLST NMAP…

Fuzzing HTTP server requests

This script can be used to do fuzzing against an HTTP server. It supports the following commands: Request type Page Protocol Host Referrer Content type User agent Cookie Content length The code is available on github. You can find it here.