Search code examples
fuzzing

boofuzz - Target connection reset, skip error


I am using boofuzz to try to fuzz a specific application. While creating the blocks etc and some testing i noticed that the target sometimes closes the connection. This causes procmon to terminate the target process and restarts it. However this is totally unnecessary for this target.

Can i somehow tell boofuzz to not handle this as an Error (so target is not restarted)

[2017-11-04 17:09:07,012]     Info: Receiving...
[2017-11-04 17:09:07,093]       Check Failed: Target connection reset.
[2017-11-04 17:09:07,093]   Test Step: Calling post_send function:
[2017-11-04 17:09:07,093]     Info: No post_send callback registered.
[2017-11-04 17:09:07,093]   Test Step: Sleep between tests.
[2017-11-04 17:09:07,094]     Info: sleeping for 0.100000 seconds
[2017-11-04 17:09:07,194]   Test Step: Contact process monitor
[2017-11-04 17:09:07,194]     Check: procmon.post_send()
[2017-11-04 17:09:07,196]       Check OK: No crash detected.

Solution

  • Excellent question! There isn't (wasn't) any way to do this, but there really should be. A reset connection does not always mean a failure.

    I just added ignore_connection_reset and ignore_connection_aborted options to the Session class to ignore ECONNRESET and ECONNABORTED errors respectively. Available in version 0.0.10.

    Description of arguments available in the docs: http://boofuzz.readthedocs.io/en/latest/source/Session.html

    You may find the commit that added these arguments informative for how some of the boofuzz internals work (relevant lines 182-183, 213-214, 741-756): https://github.com/jtpereyda/boofuzz/commit/a1f08837c755578e80f36fd1d78401f21ccbf852

    Thank you for the solid question.