Primitives
A Sulley Primitive has an interface partially defined by class BasePrimitive. The interface consists importantly of:
Mutation method.
Rendering method.
Num-mutations method to get total mutation count.
Reset method to reset the primitive to non-mutated state.
A name property.
Support for reading length.
Most of these interface elements are shared by Blocks.
BasePrimitive
Warning
When using primitives (or developing new ones), keep in mind the parameters available in the BasePrimitive :)
- class boofuzz.BasePrimitive(min_len=0, max_len=1000, seclist_path='', num_random_generations=50, num_random_mutations=40, num_library_elements=50, max_rounds_mutation=1500, *args, **kwargs)[source]
Bases:
FuzzableThe primitive base class implements common functionality shared across most primitives.
- ..versionchanged:: 1.0.0
All the parameters below and associated methods where move from the Fuzzable class to the BasePrimitive class, as some classes that are not primitives inherints from Fuzzable, and they don’t need these parameters.
- Parameters:
min_len (int, optional) – Minimum length of the generated values, defaults to 0
max_len (int, optional) – Maximum length of the generated values, defaults to 1000
num_library_elements (int, optional) – Number of elements in the library, defaults to 50
num_random_generations (int, optional) – Number of random elements to generate, defaults to 50
num_random_mutations (int, optional) – Number of random mutations to generate on one element of the initial library, defaults to 40
max_rounds_mutation (int, optional) – Maximum number of rounds of mutation, defaults to 1500. If the size of the library from which the mutations are done is greater than this value, the mutation is only done on the first max_rounds_mutation elements.
seclist_path (str, optional) – Path to the seclist file, defaults to “”
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
- mutations(default_value)[source]
Generator to yield mutation values for this element.
Values are either plain values or callable functions that take a “default value” and mutate it. Functions are used when the default or “normal” value influences the fuzzed value. Functions are used because the “normal” value is sometimes dynamic and not known at the time of generation.
Each mutation should be a pre-rendered value. That is, it must be suitable to pass to encode().
Default: Empty iterator.
- Parameters:
default_value
- num_mutations(default_value)[source]
Return the total number of mutations for this element (not counting “fuzz_values”).
Default implementation exhausts the mutations() generator, which is inefficient. Override if you can provide a value more efficiently, or if exhausting the mutations() generator has side effects.
- Parameters:
default_value – Use if number of mutations depends on the default value. Provided by FuzzableWrapper. Note: It is generally good behavior to have a consistent number of mutations for a given default value length.
- Returns:
Number of mutated forms this primitive can take
- Return type:
int
BitField
- class boofuzz.BitField(name=None, default_value=0, width=8, max_num=None, endian='<', output_format='binary', signed=False, full_range=False, mask=None, *args, **kwargs)[source]
Bases:
BasePrimitiveThe bit field primitive represents a number of variable length and is used to define all other integer types.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (int, optional) – Default integer value, defaults to 0b0
width (int, optional) – Width in bits, defaults to 8
max_num (int, optional) – Maximum number to iterate up to, defaults to None
endian (char, optional) – Endianness of the bit field (LITTLE_ENDIAN: <, BIG_ENDIAN: >), defaults to LITTLE_ENDIAN
output_format (str, optional) – Output format, “binary” or “ascii”, defaults to binary
signed (bool, optional) – Make size signed vs. unsigned (applicable only with format=”ascii”), defaults to False
full_range (bool, optional) – If enabled the field mutates through all possible values, defaults to False
fuzz_values (list, optional) – List of custom fuzz values to add to the normal mutations, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
mask (int, optional) – Only fuzz bits with a 0 in the mask, default to None
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
- mutations(default_value)[source]
Generator to yield mutation values for this element.
Values are either plain values or callable functions that take a “default value” and mutate it. Functions are used when the default or “normal” value influences the fuzzed value. Functions are used because the “normal” value is sometimes dynamic and not known at the time of generation.
Each mutation should be a pre-rendered value. That is, it must be suitable to pass to encode().
Default: Empty iterator.
- Parameters:
default_value
Byte
- class boofuzz.Byte(*args, **kwargs)[source]
Bases:
BitFieldThe byte sized bit field primitive.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (int, optional) – Default integer value, defaults to 0
max_num (int, optional) – Maximum number to iterate up to, defaults to None
endian (char, optional) – Endianness of the bit field (LITTLE_ENDIAN: <, BIG_ENDIAN: >), defaults to LITTLE_ENDIAN
output_format (str, optional) – Output format, “binary” or “ascii”, defaults to binary
signed (bool, optional) – Make size signed vs. unsigned (applicable only with format=”ascii”), defaults to False
full_range (bool, optional) – If enabled the field mutates through all possible values, defaults to False
fuzz_values (list, optional) – List of custom fuzz values to add to the normal mutations, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
Bytes
- class boofuzz.Bytes(*args, name: str = None, default_value: bytes = b'', padding: bytes = b'\x00', size: int = None, min_len: int = 0, max_len: int = 1000, use_long_bytes: bool = True, use_default_value: bool = True, **kwargs)[source]
Bases:
BasePrimitivePrimitive that fuzzes a binary byte string with arbitrary length.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, * a default name will be given, defaults to None
default_value (bytes, optional) – Value used when the element is not being fuzzed - should typically represent a valid value, defaults to b””
size (int, optional) – Deprecated, kept for retrocompatibility, use min_len and max_len. Static size of this field, leave None for dynamic, defaults to None
padding (chr, optional) – Value to use as padding to fill static field size, defaults to b”x00”
min_len (int, optional) – Minimum string length, defaults to 0
max_len (int, optional) – Maximum string length, defaults to None
max_element_by_round (int, optional) – Maximum number of elements to generate by round, defaults to 100 Truncate seclists if necessary
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
use_long_bytes (bool, optional) – Enable/disable the use of long bytes, defaults to True
use_default_value (bool, optional) – Enable/disable the use of the default value, defaults to True
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
- mutations(default_value)[source]
Generate mutations :
- If the round_type is “library”, do so using the variables and functions yielded by
_iterate_fuzz_cases. * If the element is callable, calls it. * If not, returns the element. * Checks for the size each time.
Else, if round_type is random_mutation, flip random bits in the value.
Else, if round_type is random_generation, generate random bytes of random size.
- Parameters:
default_value
- Returns:
A generator of mutated values
Delim
- class boofuzz.Delim(*args, name=None, default_value=' ', **kwargs)[source]
Bases:
StringRepresent a delimiter such as :,r,n, ,=,>,< etc… Mutations include repetition, substitution and exclusion.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (char, optional) – Value used when the element is not being fuzzed, should typically represent a valid value.
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context=None)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
- specific_long_string_seeds = [' ', '\t', '\t ', '\t\r\n', '!', '@', '#', '$', '%', '^', '&', '*', '(', ',', '{', '}', '[', ']', '-', '_', '+', '=', ':', ': ', ':7', ';', "'", '"', '/', '\\', '?', '<', '>', '.', ',', '\r', '\n', '\r\n']
DWord
- class boofuzz.DWord(*args, **kwargs)[source]
Bases:
BitFieldThe 4 byte sized bit field primitive.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (int, optional) – Default integer value, defaults to 0
max_num (int, optional) – Maximum number to iterate up to, defaults to None
endian (char, optional) – Endianness of the bit field (LITTLE_ENDIAN: <, BIG_ENDIAN: >), defaults to LITTLE_ENDIAN
output_format (str, optional) – Output format, “binary” or “ascii”, defaults to binary
signed (bool, optional) – Make size signed vs. unsigned (applicable only with format=”ascii”), defaults to False
full_range (bool, optional) – If enabled the field mutates through all possible values, defaults to False
fuzz_values (list, optional) – List of custom fuzz values to add to the normal mutations, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
FromFile
- class boofuzz.FromFile(name=None, default_value=b'', filename=None, max_len=0, *args, **kwargs)[source]
Bases:
BasePrimitiveCycles through a list of “bad” values from a file(s).
Takes filename and open the file(s) to read the values to use in fuzzing process. filename may contain glob characters.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (bytes) – Default bytes value
filename (str) – Filename pattern to load all fuzz value
max_len (int, optional) – Maximum string length, defaults to 0
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
Group
- class boofuzz.Group(name=None, values=None, default_value=None, encoding='ascii', *args, **kwargs)[source]
Bases:
BasePrimitiveThis primitive represents a list of static values, stepping through each one on mutation.
You can tie a block to a group primitive to specify that the block should cycle through all possible mutations for each value within the group. The group primitive is useful for example for representing a list of valid opcodes.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
values (list of bytes or list of str) – List of possible raw values this group can take.
default_value (str, optional) – Value used when the element is not being fuzzed - should typically represent a valid value, defaults to None
encoding (str, optional) – String encoding, ex: utf_16_le for Microsoft Unicode, defaults to ascii
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- mutations(default_value)[source]
Generator to yield mutation values for this element.
Values are either plain values or callable functions that take a “default value” and mutate it. Functions are used when the default or “normal” value influences the fuzzed value. Functions are used because the “normal” value is sometimes dynamic and not known at the time of generation.
Each mutation should be a pre-rendered value. That is, it must be suitable to pass to encode().
Default: Empty iterator.
- Parameters:
default_value
Mirror
- class boofuzz.Mirror(name=None, primitive_name=None, request=None, *args, **kwargs)[source]
Bases:
BasePrimitivePrimitive used to keep updated with another primitive.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
primitive_name (str) – Name of target primitive.
request (boofuzz.Request) – Request this primitive belongs to.
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Render the mirror.
- Parameters:
value
mutation_context
- Returns:
Rendered value.
- mutations(default_value)[source]
Generator to yield mutation values for this element.
Values are either plain values or callable functions that take a “default value” and mutate it. Functions are used when the default or “normal” value influences the fuzzed value. Functions are used because the “normal” value is sometimes dynamic and not known at the time of generation.
Each mutation should be a pre-rendered value. That is, it must be suitable to pass to encode().
Default: Empty iterator.
- Parameters:
default_value
- original_value(test_case_context=None)[source]
Original, non-mutated value of element.
- Parameters:
test_case_context (ProtocolSession) – Used to resolve ReferenceValueTestCaseSession type default values.
Returns:
MultipleDefault
- class boofuzz.MultipleDefault(name=None, values=None, default_value=None, primitive: ~boofuzz.primitives.base_primitive.BasePrimitive = <class 'boofuzz.primitives.base_primitive.BasePrimitive'>, *args, **kwargs)[source]
Bases:
BasePrimitiveThis primitive represents a list of static values, stepping through each one on mutation.
You can tie a block to a group primitive to specify that the block should cycle through all possible mutations for each value within the group. The group primitive is useful for example for representing a list of valid opcodes.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
values (list of bytes or list of str) – List of possible raw values this group can take.
default_value (str, optional) – Value used when the element is not being fuzzed - should typically represent a valid value, defaults to None
encoding (str, optional) – String encoding, ex: utf_16_le for Microsoft Unicode, defaults to ascii
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
QWord
- class boofuzz.QWord(*args, **kwargs)[source]
Bases:
BitFieldThe 8 byte sized bit field primitive.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (int, optional) – Default integer value, defaults to 0
max_num (int, optional) – Maximum number to iterate up to, defaults to None
endian (char, optional) – Endianness of the bit field (LITTLE_ENDIAN: <, BIG_ENDIAN: >), defaults to LITTLE_ENDIAN
output_format (str, optional) – Output format, “binary” or “ascii”, defaults to binary
signed (bool, optional) – Make size signed vs. unsigned (applicable only with format=”ascii”), defaults to False
full_range (bool, optional) – If enabled the field mutates through all possible values, defaults to False
fuzz_values (list, optional) – List of custom fuzz values to add to the normal mutations, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
RandomData
- class boofuzz.RandomData(*args, **kwargs)[source]
Bases:
BasePrimitiveGenerate a random chunk of data while maintaining a copy of the original.
A random length range can be specified. For a static length, set min/max length to be the same.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (str or bytes, optional) – Value used when the element is not being fuzzed - should typically represent a valid value, defaults to None
min_length (int, optional) – Minimum length of random block, defaults to 0
max_length (int, optional) – Maximum length of random block, defaults to 1
max_mutations (int, optional) – Number of mutations to make before reverting to default, defaults to 25
step (int, optional) – If not None, step count between min and max reps, otherwise random, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
Simple
- class boofuzz.Simple(name=None, default_value=None, fuzz_values=None, *args, **kwargs)[source]
Bases:
BasePrimitiveSimple bytes value with manually specified fuzz values only.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (Raw, optional) – Raw static data
fuzz_values (list, optional) – List of fuzz values, defaults to None. If empty, Simple is equivalent to Static.
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
Static
- class boofuzz.Static(name=None, default_value=None, fuzzable=False, *args, **kwargs)[source]
Bases:
BasePrimitiveStatic primitives are fixed and not mutated while fuzzing.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (Raw, optional) – Raw static data
fuzzable (bool, optional) – Normaly enable/disable fuzzing of the primitive. Originally wasn’t supported by the Static primitive, because it never fuzz. Here, we only catch it to prevent errors when using this parameter instinctively like in the other primitives. defaults to False
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
String
- class boofuzz.String(*args, name=None, default_value='', size=None, padding=b'\x00', encoding='utf-8', min_len=0, max_len=1000, len_unit='bytes', use_long_strings=True, use_default_value=True, **kwargs)[source]
Bases:
BasePrimitivePrimitive that cycles through a library of “bad” strings.
This class originally used a variable ‘fuzz_library’ containing a list of smart fuzz values global across all instances. The content was moved to a seclist file, removing the library variable.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (str) – Value used when the element is not being fuzzed. Should typically represent a valid value.
size (int, optional) – Deprecated. Static size of this field, leave None for dynamic, defaults to None. Useless with min_len and max_len, kept for retrocompatibility.
padding (chr, optional) – Value to use as padding to fill static field size, defaults to “x00”
encoding (str, optional) – String encoding, ex: utf_16_le for Microsoft Unicode, defaults to utf-8
min_len (int, optional) – Minimum string length, defaults to None
len_unit (str, optional) – Unit used to calculate length, defaults to “bytes”, can be “bytes” or “chars” If “chars”, the length is checked in ‘mutation’, else in ‘encode’.
max_len (int, optional) – Maximum string length, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
seclist_path (string, optional) – Path to seclist file, defaults to “home_made_seclists/boofuzz.txt”. Opened as utf-8.
use_long_strings (bool, optional) – Use built-in long strings, defaults to True
use_default_value (bool, optional) – Use default value in the library, defaults to True
num_random_generations (int, optional) – Number of random string to generate, defaults to 50
num_random_mutations (int, optional) – Number of mutations to generate, defaults to 40
- encode(value, mutation_context=None)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes
- long_string_seeds = ['C', '1', '<', '>', "'", '"', '/', '\\', '?', '=', 'a=', '&', '.', ',', '(', ')', ']', '[', '%', '*', '-', '+', '{', '}', '\x14', '\x00', 'þ', 'ÿ', '%þð%\x01ÿ', '/.', '/.:/', '/\\', '<>', '\r\n', 'Þ\xad¾ï']
- mutations(default_value)[source]
On first round, mutate the primitive by stepping through 4 elements, all optionnals. The fuzz library, the default value, the long string library, and a file containing a list of strings
- Parameters:
default_value (str) – Default value of element.
- Return type:
Generator of strings
- Returns:
Yield a generator of mutated strings.
Word
- class boofuzz.Word(*args, **kwargs)[source]
Bases:
BitFieldThe 2 byte sized bit field primitive.
- Parameters:
name (str, optional) – Name, for referencing later. Names should always be provided, but if not, a default name will be given, defaults to None
default_value (int, optional) – Default integer value, defaults to 0
max_num (int, optional) – Maximum number to iterate up to, defaults to None
endian (char, optional) – Endianness of the bit field (LITTLE_ENDIAN: <, BIG_ENDIAN: >), defaults to LITTLE_ENDIAN
output_format (str, optional) – Output format, “binary” or “ascii”, defaults to binary
signed (bool, optional) – Make size signed vs. unsigned (applicable only with format=”ascii”), defaults to False
full_range (bool, optional) – If enabled the field mutates through all possible values, defaults to False
fuzz_values (list, optional) – List of custom fuzz values to add to the normal mutations, defaults to None
fuzzable (bool, optional) – Enable/disable fuzzing of this primitive, defaults to true
- encode(value, mutation_context)[source]
Takes a value and encodes/renders/serializes it to a bytes (byte string).
Optional if mutations() yields bytes.
Example: Yield strings with mutations() and encode them to UTF-8 using encode().
Default behavior: Return value.
- Parameters:
value – Value to encode. Type should match the type yielded by mutations()
mutation_context (MutationContext) – Context for current mutation, if any.
- Returns:
Encoded/serialized value.
- Return type:
bytes