0f2cf80085
* nits * first steps * different approach * fixes * remove temps * remove temp * initial import * more tests * bug hunt * cleanup * yaml function target 0x.... support * final * update doc * other work * Clippy, fmt * Removed lazystatic dependency * More small cleanups * optimize to_lowercase * move funtionality to libafl_qemu * add missing file * ready * remove qemu_injections * move test files to test directory * doc update * add todos * fixes * add file comment * add test and other platform support * fix clippy * Replace Emulator::new_empty by Emulator::get. Fix visibility identifier. * clippy * let's try this * cpu_target? * fmt * cleanup build system, enable missing fuzzers * fix qemu_launcher * enable hexagon in qemu_launcher * Removed useless `any` predicate in cfg attribute. Replaced wrong types in `syscall_hook` signature. * format * move to read_function_argument * add hexagon injections support * enable injections fuzzing everywhere * unify error msg * Fix build, add initial toml support * intermediate push, wip * fix build * More WIP * Fix build * Clippy * fix qemu * Fix arm * fix more wrong things * fix testcase * try to fix it again? * more release? * make makefile independent of dev/release * trying more fix? * More ugly more works * more trying to fix the testcase * allow yml as filename too * more docs --------- Co-authored-by: Dominik Maier <dmnk@google.com> Co-authored-by: Romain Malmain <romain.malmain@pm.me> Co-authored-by: Dominik Maier <domenukk@gmail.com>
80 lines
2.6 KiB
YAML
80 lines
2.6 KiB
YAML
# The YAML Structure:
|
|
#
|
|
# You can specify multiple different injection types if you want.
|
|
# -name: "name" # any name you want, it is not important
|
|
# functions:
|
|
# # multiple function targets to hook can be defined
|
|
# - function: "function_name" # name of the function you want to hook.
|
|
# # if the function name starts with 0x then
|
|
# # this is the QEMU Guest address of a
|
|
# # function you want to hook that does not
|
|
# # have a symbol.
|
|
# parameter: number # which parameter to the function contains the string
|
|
# # 0 = first, 1 = second, ... 0-5 are supported (depending on architecture)
|
|
# tests:
|
|
# # multiple tests can be defined.
|
|
# - input_value: "a string" # the injection string to add to the tokens list
|
|
# match_value: "a string" # if this substring (case insensitive) is found
|
|
# # in the parameter of the function then crash!
|
|
# # note that this is not a regex.
|
|
#
|
|
- name: "sql"
|
|
functions:
|
|
- function: "sqlite3_exec"
|
|
parameter: 1
|
|
- function: "PQexec"
|
|
parameter: 1
|
|
- function: "PQexecParams"
|
|
parameter: 1
|
|
- function: "mysql_query"
|
|
parameter: 1
|
|
- function: "mysql_send_query"
|
|
parameter: 1
|
|
tests:
|
|
- input_value: "'\"\"'"
|
|
match_value: "'\"\"'"
|
|
# this one is not needed, just to show you can have many entries:
|
|
- input_value: "1\" OR '1'=\"1"
|
|
match_value: "1\" OR '1'=\"1"
|
|
|
|
# Command injection. Note that for most you will need a libc with debug symbols
|
|
# We do not need this as we watch the SYS_execve syscall, this is just an
|
|
# example.
|
|
- name: "cmd"
|
|
functions:
|
|
- function: "popen"
|
|
parameter: 0
|
|
- function: "system"
|
|
parameter: 0
|
|
tests:
|
|
# basically a dummy because we load the better ones at src/client.rs
|
|
- input_value: "'\"FUZZ\"'"
|
|
match_value: "'\"FUZZ\"'"
|
|
- input_value: "\";FUZZ;\""
|
|
match_value: "'\"FUZZ\"'"
|
|
- input_value: "';FUZZ;'"
|
|
match_value: "'\"FUZZ\"'"
|
|
- input_value: "$(FUZZ)"
|
|
match_value: "'\"FUZZ\"'"
|
|
|
|
# LDAP injection tests
|
|
- name: "ldap"
|
|
functions:
|
|
- function: "ldap_search_ext"
|
|
parameter: 3
|
|
- function: "ldap_search_ext_s"
|
|
parameter: 3
|
|
tests:
|
|
- input_value: "*)(FUZZ=*))(|"
|
|
match_value: "*)(FUZZ=*))(|"
|
|
|
|
# XSS injection tests
|
|
# This is a minimal example that only checks for libxml2
|
|
- name: "xss"
|
|
functions:
|
|
- function: "htmlReadMemory"
|
|
parameter: 0
|
|
tests:
|
|
- input_value: "'\"><FUZZ"
|
|
match_value: "'\"><FUZZ"
|