proxyfuzz.py

#    Proxyfuzz - On the fly TCP and UDP network fuzzer
#    Copyright (C) 2011 Rodrigo Marcos
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
#    Proxyfuzz: a TCP and UDP proxy man-in-the-middle fuzzer
#    v 0.1
#    By Rodrigo Marcos
#    http://www.secforce.co.uk


# Changes by floyd in 2013

from twisted.protocols import portforward
from twisted.internet.protocol import DatagramProtocol
from twisted.internet import reactor
import getopt, sys
from random import randint


# UDP Proxy stuff

class Client(DatagramProtocol):
    def __init__(self, server, host, port):
        self.server = server
        self.host = host
        self.port = port

    def startProtocol(self):
        self.transport.connect(desthost, destport)

    def datagramReceived(self, data, (host, port)):
        global verbose
        global notuntil
        global request
        global testclient

        if testclient:
            if request < notuntil:
                request = request + 1
            else:
                data = fuzz(data)
        if verbose:
            print "Server ------> Client"
            print "%r" % data

        self.server.transport.write(data, (self.host, self.port))


class Server(DatagramProtocol):
    client = None

    def datagramReceived(self, data, (host, port)):
        if not self.client or self.client.host != host or self.client.port != port:
            self.client = Client(self, host, port)
            reactor.listenUDP(0, self.client)

        global verbose
        global notuntil
        global request
        global testserver

        if testserver:
            if request < notuntil:
                request = request + 1
            else:
                data = fuzz(data)
        if verbose:
            print "Client ------> Server"
            print "%r" % data
        self.client.transport.write(data, (desthost, destport))


# TCP proxy stuff

def server_dataReceived(self, data):
    global verbose
    global notuntil
    global request
    global testserver

    if testserver:
        if request < notuntil:
            request = request + 1
        else:
            data = fuzz(data)

    if verbose:
        print "Client ------> server"
        print "%r" % data

    portforward.Proxy.dataReceived(self, data)


portforward.ProxyServer.dataReceived = server_dataReceived


def client_dataReceived(self, data):
    global verbose
    global notuntil
    global request
    global testclient

    if testclient:
        if request < notuntil:
            request = request + 1
        else:
            data = fuzz(data)
    if verbose:
        print "Server ------> Client"
        print "%r" % data

    portforward.Proxy.dataReceived(self, data)


portforward.ProxyClient.dataReceived = client_dataReceived

overflowstrings = ["A" * 255, "A" * 256, "A" * 257, "A" * 420, "A" * 511, "A" * 512, "A" * 1023, "A" * 1024, "A" * 2047,
                   "A" * 2048, "A" * 4096, "A" * 4097, "A" * 5000, "A" * 10000, "A" * 20000, "A" * 32762, "A" * 32763,
                   "A" * 32764, "A" * 32765, "A" * 32766, "A" * 32767, "A" * 32768, "A" * 65534, "A" * 65535,
                   "A" * 65536, "%x" * 1024, "%n" * 1025, "%s" * 2048, "%s%n%x%d" * 5000, "%s" * 30000, "%s" * 40000,
                   "%.1024d", "%.2048d", "%.4096d", "%.8200d", "%99999999999s", "%99999999999d", "%99999999999x",
                   "%99999999999n", "%99999999999s" * 1000, "%99999999999d" * 1000, "%99999999999x" * 1000,
                   "%99999999999n" * 1000, "%08x" * 100, "%%20s" * 1000, "%%20x" * 1000, "%%20n" * 1000, "%%20d" * 1000,
                   "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x",
                   "'", "\\", "<", "+", "%", "$", "`"]


def bitflipping(data):
    l = len(data)
    n = int(l * 7 / 100)  # 7% of the bytes to be modified

    for i in range(0, n):  # We change the bytes
        r = randint(0, l - 1)
        data = data[0:r] + chr(randint(0, 255)) + data[r + 1:]
    return data


def bofinjection(data):
    l = len(data)
    r = randint(0, len(overflowstrings) - 1)
    data = data[0:r] + overflowstrings[r] + data[r - l:]
    return data


def fuzz(data):
    r = randint(0, 5)
    if r == 0:
        data = bitflipping(data)

    r = randint(0, 5)
    if r == 0:
        data = bofinjection(data)
    return data


def startudpproxy():
    reactor.listenUDP(localport, Server())
    reactor.run()


def starttcpproxy():
    reactor.listenTCP(localport, portforward.ProxyFactory(desthost, destport))
    reactor.run()


def usage():
    # print "###############################################################"
    print
    print "ProxyFuzz 0.1, Simple fuzzing proxy by Rodrigo Marcos"
    print "http://www.secforce.co.uk"
    print
    print "usage():"
    # print
    print "python proxyfuzz -l <localport> -r <remotehost> -p <remoteport> [options]"
    print
    print " [options]"
    print "		-c: Fuzz only client side (both otherwise)"
    print "		-s: Fuzz only server side (both otherwise)"
    print "		-w: Number of requests to send before start fuzzing"
    print "		-u: UDP protocol (otherwise TCP is used)"
    print "		-v: Verbose (outputs network traffic)"
    print "		-h: Help page"


verbose = False
notuntil = 0
request = 0
proto = "tcp"
localport = 0
desthost = ""
destport = 0
testclient = 1
testserver = 1


def main():
    global verbose
    global notuntil
    global proto
    global localport
    global desthost
    global destport
    global testclient
    global testserver

    try:
        opts, args = getopt.getopt(sys.argv[1:], "uvhcsl:r:p:w:", ["help"])
    except getopt.GetoptError:
        usage()
        sys.exit(2)
    try:
        for o, a in opts:
            if o in ("-h", "--help"):
                usage()
                sys.exit()
            if o == "-l":
                localport = int(a)
            if o == "-r":
                desthost = a
            if o == "-p":
                destport = int(a)
            if o == "-v":
                verbose = True
            if o == "-w":
                notuntil = int(a)
            if o == "-u":
                proto = "udp"
            if o == "-c":  # Only client
                testserver = 0
            if o == "-s":  # Only server
                testclient = 0

    except:
        usage()
        sys.exit(2)

    if testserver == 0 and testclient == 0:
        usage()
        sys.exit(2)
    elif localport == 0 or desthost == "" or destport == 0:
        usage()
        sys.exit(2)
    else:
        if proto == "tcp":
            starttcpproxy()
        else:  # UDP
            startudpproxy()


if __name__ == "__main__":
    main()