rfuzz 0.6
Sign up to get free protection for your applications and to get access to all the features.
- data/COPYING +55 -0
- data/LICENSE +55 -0
- data/README +252 -0
- data/Rakefile +48 -0
- data/doc/rdoc/classes/RFuzz.html +146 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.html +481 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000010.html +24 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000011.html +34 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000012.html +49 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000013.html +49 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000014.html +57 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000015.html +37 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000016.html +26 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000017.html +34 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000018.html +18 -0
- data/doc/rdoc/classes/RFuzz/HttpClient.src/M000019.html +26 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.html +294 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000001.html +26 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000002.html +18 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000003.html +26 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000004.html +18 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000005.html +32 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000006.html +18 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000007.html +20 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000008.html +20 -0
- data/doc/rdoc/classes/RFuzz/HttpEncoding.src/M000009.html +32 -0
- data/doc/rdoc/classes/RFuzz/HttpResponse.html +180 -0
- data/doc/rdoc/classes/RFuzz/Notifier.html +252 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000044.html +17 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000045.html +17 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000046.html +17 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000047.html +17 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000048.html +17 -0
- data/doc/rdoc/classes/RFuzz/Notifier.src/M000049.html +17 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.html +362 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000032.html +21 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000033.html +23 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000036.html +22 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000037.html +20 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000038.html +22 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000039.html +20 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000040.html +18 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000041.html +18 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000042.html +22 -0
- data/doc/rdoc/classes/RFuzz/RandomGenerator.src/M000043.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.html +383 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000056.html +19 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000057.html +23 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000058.html +26 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000059.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000060.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000061.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000062.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000063.html +19 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000064.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000065.html +23 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000066.html +18 -0
- data/doc/rdoc/classes/RFuzz/Sampler.src/M000067.html +20 -0
- data/doc/rdoc/classes/RFuzz/Session.html +415 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000020.html +31 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000021.html +18 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000022.html +18 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000023.html +34 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000024.html +19 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000025.html +19 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000026.html +26 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000027.html +29 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000028.html +19 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000029.html +18 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000030.html +18 -0
- data/doc/rdoc/classes/RFuzz/Session.src/M000031.html +23 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.html +242 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000050.html +19 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000051.html +19 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000052.html +18 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000053.html +18 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000054.html +28 -0
- data/doc/rdoc/classes/RFuzz/StatsTracker.src/M000055.html +18 -0
- data/doc/rdoc/created.rid +1 -0
- data/doc/rdoc/files/COPYING.html +168 -0
- data/doc/rdoc/files/LICENSE.html +168 -0
- data/doc/rdoc/files/README.html +473 -0
- data/doc/rdoc/files/lib/rfuzz/client_rb.html +111 -0
- data/doc/rdoc/files/lib/rfuzz/random_rb.html +116 -0
- data/doc/rdoc/files/lib/rfuzz/rfuzz_rb.html +109 -0
- data/doc/rdoc/files/lib/rfuzz/session_rb.html +111 -0
- data/doc/rdoc/files/lib/rfuzz/stats_rb.html +113 -0
- data/doc/rdoc/fr_class_index.html +35 -0
- data/doc/rdoc/fr_file_index.html +34 -0
- data/doc/rdoc/fr_method_index.html +93 -0
- data/doc/rdoc/index.html +24 -0
- data/doc/rdoc/rdoc-style.css +208 -0
- data/examples/amazon_headers.rb +38 -0
- data/examples/hpricot_pudding.rb +22 -0
- data/examples/kill_routes.rb +26 -0
- data/examples/mongrel_test_suite/lib/gen.rb +24 -0
- data/examples/mongrel_test_suite/test/camping/static_files.rb +9 -0
- data/examples/mongrel_test_suite/test/camping/upload_file.rb +9 -0
- data/examples/mongrel_test_suite/test/camping/upload_progress.rb +9 -0
- data/examples/mongrel_test_suite/test/http/base_protocol.rb +23 -0
- data/examples/mongrel_test_suite/test/nitro/upload_file.rb +9 -0
- data/examples/mongrel_test_suite/test/nitro/upload_progress.rb +9 -0
- data/examples/mongrel_test_suite/test/rails/static_files.rb +9 -0
- data/examples/mongrel_test_suite/test/rails/upload_file.rb +9 -0
- data/examples/mongrel_test_suite/test/rails/upload_progress.rb +9 -0
- data/examples/perftest.rb +30 -0
- data/ext/fuzzrnd/ext_help.h +14 -0
- data/ext/fuzzrnd/extconf.rb +6 -0
- data/ext/fuzzrnd/fuzzrnd.c +149 -0
- data/ext/http11_client/ext_help.h +14 -0
- data/ext/http11_client/extconf.rb +6 -0
- data/ext/http11_client/http11_client.c +288 -0
- data/ext/http11_client/http11_parser.c +629 -0
- data/ext/http11_client/http11_parser.h +46 -0
- data/ext/http11_client/http11_parser.rl +169 -0
- data/lib/rfuzz/client.rb +498 -0
- data/lib/rfuzz/random.rb +110 -0
- data/lib/rfuzz/rfuzz.rb +12 -0
- data/lib/rfuzz/session.rb +154 -0
- data/lib/rfuzz/stats.rb +159 -0
- data/resources/defaults.yaml +2 -0
- data/resources/words.txt +3310 -0
- data/test/coverage/index.html +388 -0
- data/test/coverage/lib-rfuzz-client_rb.html +1127 -0
- data/test/coverage/lib-rfuzz-random_rb.html +739 -0
- data/test/coverage/lib-rfuzz-session_rb.html +783 -0
- data/test/coverage/lib-rfuzz-stats_rb.html +788 -0
- data/test/server.rb +101 -0
- data/test/test_client.rb +164 -0
- data/test/test_fuzzrnd.rb +31 -0
- data/test/test_httpparser.rb +48 -0
- data/test/test_random.rb +75 -0
- data/test/test_session.rb +33 -0
- data/test/test_stats.rb +45 -0
- data/tools/rakehelp.rb +119 -0
- metadata +201 -0
|
@@ -0,0 +1,473 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="iso-8859-1"?>
|
|
2
|
+
<!DOCTYPE html
|
|
3
|
+
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
4
|
+
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
5
|
+
|
|
6
|
+
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
7
|
+
<head>
|
|
8
|
+
<title>File: README</title>
|
|
9
|
+
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
|
|
10
|
+
<meta http-equiv="Content-Script-Type" content="text/javascript" />
|
|
11
|
+
<link rel="stylesheet" href=".././rdoc-style.css" type="text/css" media="screen" />
|
|
12
|
+
<script type="text/javascript">
|
|
13
|
+
// <![CDATA[
|
|
14
|
+
|
|
15
|
+
function popupCode( url ) {
|
|
16
|
+
window.open(url, "Code", "resizable=yes,scrollbars=yes,toolbar=no,status=no,height=150,width=400")
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
function toggleCode( id ) {
|
|
20
|
+
if ( document.getElementById )
|
|
21
|
+
elem = document.getElementById( id );
|
|
22
|
+
else if ( document.all )
|
|
23
|
+
elem = eval( "document.all." + id );
|
|
24
|
+
else
|
|
25
|
+
return false;
|
|
26
|
+
|
|
27
|
+
elemStyle = elem.style;
|
|
28
|
+
|
|
29
|
+
if ( elemStyle.display != "block" ) {
|
|
30
|
+
elemStyle.display = "block"
|
|
31
|
+
} else {
|
|
32
|
+
elemStyle.display = "none"
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
return true;
|
|
36
|
+
}
|
|
37
|
+
|
|
38
|
+
// Make codeblocks hidden by default
|
|
39
|
+
document.writeln( "<style type=\"text/css\">div.method-source-code { display: none }</style>" )
|
|
40
|
+
|
|
41
|
+
// ]]>
|
|
42
|
+
</script>
|
|
43
|
+
|
|
44
|
+
</head>
|
|
45
|
+
<body>
|
|
46
|
+
|
|
47
|
+
|
|
48
|
+
|
|
49
|
+
<div id="fileHeader">
|
|
50
|
+
<h1>README</h1>
|
|
51
|
+
<table class="header-table">
|
|
52
|
+
<tr class="top-aligned-row">
|
|
53
|
+
<td><strong>Path:</strong></td>
|
|
54
|
+
<td>README
|
|
55
|
+
</td>
|
|
56
|
+
</tr>
|
|
57
|
+
<tr class="top-aligned-row">
|
|
58
|
+
<td><strong>Last Update:</strong></td>
|
|
59
|
+
<td>Wed Jul 19 17:15:09 EDT 2006</td>
|
|
60
|
+
</tr>
|
|
61
|
+
</table>
|
|
62
|
+
</div>
|
|
63
|
+
<!-- banner header -->
|
|
64
|
+
|
|
65
|
+
<div id="bodyContent">
|
|
66
|
+
|
|
67
|
+
|
|
68
|
+
|
|
69
|
+
<div id="contextContent">
|
|
70
|
+
|
|
71
|
+
<div id="description">
|
|
72
|
+
<h1><a href="../classes/RFuzz.html">RFuzz</a> HTTP Destroyer</h1>
|
|
73
|
+
<p>
|
|
74
|
+
<a href="../classes/RFuzz.html">RFuzz</a> is the start of a Ruby based HTTP
|
|
75
|
+
thrasher, destroyer, fuzzer, and client based on the Mongrel
|
|
76
|
+
project’s HTTP parser and the statistical analysis of being very mean
|
|
77
|
+
to a web server.
|
|
78
|
+
</p>
|
|
79
|
+
<p>
|
|
80
|
+
At the moment is has a working and fairly extensive HTTP 1.1 client and
|
|
81
|
+
some basic statistics math borrowed from the Mongrel project.
|
|
82
|
+
</p>
|
|
83
|
+
<p>
|
|
84
|
+
In order for the test cases to run you need to start any Rails project on
|
|
85
|
+
port 3000. Future releases will have tests starting built-in Mongrel
|
|
86
|
+
servers to validate client functionality.
|
|
87
|
+
</p>
|
|
88
|
+
<h2>Motivation</h2>
|
|
89
|
+
<p>
|
|
90
|
+
The motivation for <a href="../classes/RFuzz.html">RFuzz</a> comes from
|
|
91
|
+
little scripts I’ve written during Mongrel development to
|
|
92
|
+
"fuzz" or attack the Mongrel code.
|
|
93
|
+
</p>
|
|
94
|
+
<p>
|
|
95
|
+
<a href="../classes/RFuzz.html">RFuzz</a> will simply use the built-in
|
|
96
|
+
ultra-correct HTTP client and a Ruby DSL to let you write scripts that
|
|
97
|
+
exploit servers, thrash them with random data, or simply run simple test
|
|
98
|
+
suites.
|
|
99
|
+
</p>
|
|
100
|
+
<p>
|
|
101
|
+
It may also perform analysis of performance data and work as a simply load
|
|
102
|
+
or pen testing tool. This is only a secondary goal though since
|
|
103
|
+
there’s plenty of good tools for that.
|
|
104
|
+
</p>
|
|
105
|
+
<h2>Downloading</h2>
|
|
106
|
+
<p>
|
|
107
|
+
Right now <a href="../classes/RFuzz.html">RFuzz</a> just sits on my server,
|
|
108
|
+
so you can download <a
|
|
109
|
+
href="http://www.zedshaw.com/projects/rfuzz/rfuzz-0.4.gem">www.zedshaw.com/projects/rfuzz/rfuzz-0.4.gem</a>
|
|
110
|
+
or <a
|
|
111
|
+
href="http://www.zedshaw.com/projects/rfuzz/rfuzz-0.4.tgz">www.zedshaw.com/projects/rfuzz/rfuzz-0.4.tgz</a>
|
|
112
|
+
for the 0.4 version.
|
|
113
|
+
</p>
|
|
114
|
+
<p>
|
|
115
|
+
Once it can actually be used to fuzz a system I’ll make a RubyForge
|
|
116
|
+
project.
|
|
117
|
+
</p>
|
|
118
|
+
<h2><a href="../classes/RFuzz.html">RFuzz</a> HTTP Client</h2>
|
|
119
|
+
<p>
|
|
120
|
+
It also comes from not being satisfied with the stock net/http library.
|
|
121
|
+
While this library is good for high-level HTTP access to resources, it is
|
|
122
|
+
much too abstract and protective to be used in a fuzzing tool.
|
|
123
|
+
</p>
|
|
124
|
+
<p>
|
|
125
|
+
In a tool such as <a href="../classes/RFuzz.html">RFuzz</a> you need to
|
|
126
|
+
have the following features in an HTTP client library:
|
|
127
|
+
</p>
|
|
128
|
+
<ol>
|
|
129
|
+
<li>No protection from exceptions to analyze exactly what’s happening.
|
|
130
|
+
|
|
131
|
+
</li>
|
|
132
|
+
<li>Ability to "throttle" the client to simulate different kinds of
|
|
133
|
+
request loads.
|
|
134
|
+
|
|
135
|
+
</li>
|
|
136
|
+
<li>No threading or additional overhead to test the impact of threads, but
|
|
137
|
+
thread safe.
|
|
138
|
+
|
|
139
|
+
</li>
|
|
140
|
+
<li>Ability to encode the majority of the request as data elements for loading.
|
|
141
|
+
|
|
142
|
+
</li>
|
|
143
|
+
<li>Fast and exact HTTP parser to validate the server’s response is
|
|
144
|
+
correct.
|
|
145
|
+
|
|
146
|
+
</li>
|
|
147
|
+
<li>Tracks cookies between requests to keep session data going.
|
|
148
|
+
|
|
149
|
+
</li>
|
|
150
|
+
</ol>
|
|
151
|
+
<p>
|
|
152
|
+
<a href="../classes/RFuzz/HttpClient.html">RFuzz::HttpClient</a> supports
|
|
153
|
+
all of these features already, with cookies being the weakest right now.
|
|
154
|
+
</p>
|
|
155
|
+
<h3>Using The Client</h3>
|
|
156
|
+
<p>
|
|
157
|
+
The client is designed that you create an <a
|
|
158
|
+
href="../classes/RFuzz/HttpClient.html">RFuzz::HttpClient</a> object once
|
|
159
|
+
with all the common parameters and the host you want to talk with, and then
|
|
160
|
+
you call a series of methods on the client object that match the HTTP
|
|
161
|
+
methods GET, POST, PUT, DELETE, and HEAD. You can add more methods if you
|
|
162
|
+
like (see the documentation).
|
|
163
|
+
</p>
|
|
164
|
+
<p>
|
|
165
|
+
Here’s a simple example:
|
|
166
|
+
</p>
|
|
167
|
+
<pre>
|
|
168
|
+
require 'rfuzz/client'
|
|
169
|
+
|
|
170
|
+
cl = RFuzz::HttpClient.new("www.google.com", 80, :query => {"q" => "zed shaw"})
|
|
171
|
+
|
|
172
|
+
resp = cl.get("/search")
|
|
173
|
+
resp.http_body.grep(/zed/)
|
|
174
|
+
=> ["<html><head><meta HTTP-EQUIV=\"content-type\" CONTENT=\"text/html;
|
|
175
|
+
charset=ISO-8859-1\"><title>zed shaw - Google Search</title><style><!--\n"]
|
|
176
|
+
|
|
177
|
+
resp = cl.get("/search", :query => {"q" => "frank"})
|
|
178
|
+
=> ["<html><head><meta HTTP-EQUIV=\"content-type\" CONTENT=\"text/html;
|
|
179
|
+
charset=ISO-8859-1\"><title>frank - Google Search</title><style><!--\n"]
|
|
180
|
+
</pre>
|
|
181
|
+
<p>
|
|
182
|
+
Notice that we made a client that actually had a default :query to just
|
|
183
|
+
search for my name (Zed Shaw) and then we only had to
|
|
184
|
+
cl.get("/search"). In the second query though we just set :query
|
|
185
|
+
to something else (a search for "frank") and it automatically
|
|
186
|
+
overrides the parameters. This makes it possible to set common parameters,
|
|
187
|
+
cookies, and headers in blocks of requests to reduce repetition.
|
|
188
|
+
</p>
|
|
189
|
+
<h3>Client Limitations</h3>
|
|
190
|
+
<p>
|
|
191
|
+
You can use the HTTP client right now to do HTTP requests and it is
|
|
192
|
+
probably a lot easier than net/http for most requests that don’t
|
|
193
|
+
require complex POST bodies encoding. It also contains full documentation
|
|
194
|
+
and has a full suite of encoding and decoding libraries. It can’t
|
|
195
|
+
handle large HTTP bodies yet.
|
|
196
|
+
</p>
|
|
197
|
+
<p>
|
|
198
|
+
It can’t also parse cookies properly yet, so the above example kind
|
|
199
|
+
of works, but the cookie isn’t returned right.
|
|
200
|
+
</p>
|
|
201
|
+
<h2>Randomness Generator</h2>
|
|
202
|
+
<p>
|
|
203
|
+
<a href="../classes/RFuzz.html">RFuzz</a> features a RandomGenerator class
|
|
204
|
+
that uses the ArcFour random number generation algorithm to generate lots
|
|
205
|
+
of random garbage very fast in various formats. <a
|
|
206
|
+
href="../classes/RFuzz.html">RFuzz</a> will use this to send the garbage it
|
|
207
|
+
needs to the application in an attempt to find forms that can’t
|
|
208
|
+
handle nastiness, badly implemented servers, etc. It’s amazing how
|
|
209
|
+
many bugs you actually can find by sending junk to an application.
|
|
210
|
+
</p>
|
|
211
|
+
<p>
|
|
212
|
+
The types of randomness you can generate are:
|
|
213
|
+
</p>
|
|
214
|
+
<ul>
|
|
215
|
+
<li>words — <a href="../classes/RFuzz.html">RFuzz</a> includes a simple
|
|
216
|
+
word list, but you can add your own.
|
|
217
|
+
|
|
218
|
+
</li>
|
|
219
|
+
<li>base64 — Arrays of base64 encoded junk.
|
|
220
|
+
|
|
221
|
+
</li>
|
|
222
|
+
<li>byte_array — Arrays of just junk.
|
|
223
|
+
|
|
224
|
+
</li>
|
|
225
|
+
<li>uris — Arrays of URIs composed of words strung together with /.
|
|
226
|
+
|
|
227
|
+
</li>
|
|
228
|
+
<li>ints — Random integers (with an allowed maximum).
|
|
229
|
+
|
|
230
|
+
</li>
|
|
231
|
+
<li>floats — Random floats.
|
|
232
|
+
|
|
233
|
+
</li>
|
|
234
|
+
<li>headers,queries — Hashes of key=value where the keys and values can
|
|
235
|
+
be any of the above.
|
|
236
|
+
|
|
237
|
+
</li>
|
|
238
|
+
</ul>
|
|
239
|
+
<p>
|
|
240
|
+
The ArcFour fuzzrnd random generator is in a C extension so it’s
|
|
241
|
+
small and fast. A big advantage of fuzzrnd is that it generates the same
|
|
242
|
+
stream of random bytes for the same input seeds. This lets you set a seed
|
|
243
|
+
and then if you find an error replay the same attack but still have random
|
|
244
|
+
data.
|
|
245
|
+
</p>
|
|
246
|
+
<p>
|
|
247
|
+
An example of using RandomGenerator is:
|
|
248
|
+
</p>
|
|
249
|
+
<pre>
|
|
250
|
+
g = RFuzz::RandomGenerator.new(open("resources/words.txt").read.split("\n"))
|
|
251
|
+
h = g.headers(2,4,type=:ints)
|
|
252
|
+
=> [{1398667391=>2615968266, 465122870=>2683411899, 2100652296=>4131806743,
|
|
253
|
+
158954822=>2544978312}, {3126281447=>2247028995, 269763016=>1444943723,
|
|
254
|
+
2401569363=>1661839605, 2811294153=>400252371}]
|
|
255
|
+
</pre>
|
|
256
|
+
<p>
|
|
257
|
+
As you can see this produces 2 hashes consisting of 4 key=value pairs with
|
|
258
|
+
integers in them. You can quickly replace type=:ints with type=:words and
|
|
259
|
+
get:
|
|
260
|
+
</p>
|
|
261
|
+
<pre>
|
|
262
|
+
=> [{"Europeanizes"=>"Byronize's", "royalization's"=>"Americanizer's",
|
|
263
|
+
"celiorrhea"=>"unliteralized", "unvictimized"=>"doctrinize"},
|
|
264
|
+
{"pouder"=>"unchloridized", "chattelize"=>"unmodernize",
|
|
265
|
+
"uncrystallizability"=>"uncenter", "Egyptianization's"=>"ostracization's"}]
|
|
266
|
+
</pre>
|
|
267
|
+
<p>
|
|
268
|
+
Using the included dictionary of words.
|
|
269
|
+
</p>
|
|
270
|
+
<h1>Fuzzing Sessions And Statistics</h1>
|
|
271
|
+
<p>
|
|
272
|
+
The main way that you’ll use <a
|
|
273
|
+
href="../classes/RFuzz.html">RFuzz</a> is to use the <a
|
|
274
|
+
href="../classes/RFuzz/Session.html">RFuzz::Session</a> class to perform <a
|
|
275
|
+
href="../classes/RFuzz.html">RFuzz</a> runs and store the results in
|
|
276
|
+
various .csv files for analysis later. <a
|
|
277
|
+
href="../classes/RFuzz.html">RFuzz</a> makes the stance that it
|
|
278
|
+
shouldn’t be used for analyzing the data, but rather it should
|
|
279
|
+
generate information that you can put through a better tool. Examples of
|
|
280
|
+
such tools are R, gnuplot, ploticus, or a spreadsheet.
|
|
281
|
+
</p>
|
|
282
|
+
<p>
|
|
283
|
+
The Session class is initialized in a similar fashion to the HttpClient,
|
|
284
|
+
except you can’t set the :notifier (it’s used to collect
|
|
285
|
+
statistics about the requests). Once you have a Session object you call
|
|
286
|
+
it’s Session#run method to do a run of a set of samples and then put
|
|
287
|
+
your tests inside a block.
|
|
288
|
+
</p>
|
|
289
|
+
<p>
|
|
290
|
+
When a run is done it saves the results to two CSV files so you can analyze
|
|
291
|
+
them.
|
|
292
|
+
</p>
|
|
293
|
+
<p>
|
|
294
|
+
Here’s a small sample of how Session is used:
|
|
295
|
+
</p>
|
|
296
|
+
<pre>
|
|
297
|
+
require 'rfuzz/session'
|
|
298
|
+
include RFuzz
|
|
299
|
+
s = Session.new :host => "localhost", :port => 3000
|
|
300
|
+
s.run 5, :save_as => ["runs.csv","counts.csv"] do |c,r|
|
|
301
|
+
uris = r.uris(50,r.num(30))
|
|
302
|
+
uris.each do |u|
|
|
303
|
+
s.count_errors(:words) do
|
|
304
|
+
resp = c.get(u)
|
|
305
|
+
s.count resp.http_status
|
|
306
|
+
end
|
|
307
|
+
end
|
|
308
|
+
end
|
|
309
|
+
</pre>
|
|
310
|
+
<p>
|
|
311
|
+
If you run this (having a server at localhost:3000) you’ll find two
|
|
312
|
+
files in the current directory: runs.csv and counts.csv. These files might
|
|
313
|
+
look like this:
|
|
314
|
+
</p>
|
|
315
|
+
<pre>
|
|
316
|
+
-- runs.csv --
|
|
317
|
+
run,name,sum,sumsq,n,mean,sd,min,max
|
|
318
|
+
0,request,0.517807,0.010310748693,50.0,0.01035614,0.0100491312529583,0.001729,0.074479
|
|
319
|
+
1,request,0.48696,0.010552774434,50.0,0.0097392,0.0108892135376889,0.001667,0.081887
|
|
320
|
+
2,request,0.322049,0.004898592637,50.0,0.00644098,0.00759199560893725,0.000806,0.057761
|
|
321
|
+
3,request,0.271233,0.004324191489,50.0,0.00542466,0.00763028964494234,0.000828,0.057182
|
|
322
|
+
4,request,0.27697,0.001659079814,50.0,0.0055394,0.00159611899203497,0.000791,0.010722
|
|
323
|
+
|
|
324
|
+
-- counts.csv --
|
|
325
|
+
run,404,200
|
|
326
|
+
0,46,4
|
|
327
|
+
1,41,9
|
|
328
|
+
2,48,2
|
|
329
|
+
3,42,8
|
|
330
|
+
4,49,1
|
|
331
|
+
</pre>
|
|
332
|
+
<p>
|
|
333
|
+
You can then easily load these two files into any tool you want to analyze
|
|
334
|
+
the results.
|
|
335
|
+
</p>
|
|
336
|
+
<h3>Counts vs. Samples vs. Runs</h3>
|
|
337
|
+
<p>
|
|
338
|
+
Something many people don’t do correctly which <a
|
|
339
|
+
href="../classes/RFuzz.html">RFuzz</a> tries to implicitly enforce is that
|
|
340
|
+
doing just one run isn’t as useful as doing a set of runs. You might
|
|
341
|
+
not be familiar with the terminology, so let’s cover that first.
|
|
342
|
+
</p>
|
|
343
|
+
<ul>
|
|
344
|
+
<li>count — Just a simple count of some variable during a run.
|
|
345
|
+
|
|
346
|
+
</li>
|
|
347
|
+
<li>sample — A sample is the result of taking a measurement during a run.
|
|
348
|
+
|
|
349
|
+
</li>
|
|
350
|
+
<li>run — This is a test that you perform and then collect counts and
|
|
351
|
+
samples for.
|
|
352
|
+
|
|
353
|
+
</li>
|
|
354
|
+
</ul>
|
|
355
|
+
<p>
|
|
356
|
+
In the above sample script, we are doing the following:
|
|
357
|
+
</p>
|
|
358
|
+
<ul>
|
|
359
|
+
<li>5 runs.
|
|
360
|
+
|
|
361
|
+
</li>
|
|
362
|
+
<li>That do GET requests for up to 50 randomly selected URIs.
|
|
363
|
+
|
|
364
|
+
</li>
|
|
365
|
+
<li>Counting errors, HTTP status codes.
|
|
366
|
+
|
|
367
|
+
</li>
|
|
368
|
+
<li>And gathers stats on the request timing (Session does this automatically).
|
|
369
|
+
|
|
370
|
+
</li>
|
|
371
|
+
</ul>
|
|
372
|
+
<p>
|
|
373
|
+
If you were to structure this into a data structure it would like this:
|
|
374
|
+
</p>
|
|
375
|
+
<pre>
|
|
376
|
+
[
|
|
377
|
+
["run", "name", "sum", "sumsq", "n", "mean", "sd", "min", "max"],
|
|
378
|
+
[0, :request, 0.605363, 0.0149, 50.0, 0.0121, 0.0124, 0.00851, 0.095579],
|
|
379
|
+
[1, :request, 0.520827, 0.0116, 50.0, 0.0104, 0.0112, 0.00189, 0.088004],
|
|
380
|
+
...
|
|
381
|
+
]
|
|
382
|
+
</pre>
|
|
383
|
+
<p>
|
|
384
|
+
Taking a look at this, we have run 0, run 1, … and then each
|
|
385
|
+
"row" has a set of satistics we’ve gathered on the HTTP
|
|
386
|
+
request (shown as "name"). These statistics are actually
|
|
387
|
+
generated from the random 50 URI requests we built with this set of code:
|
|
388
|
+
</p>
|
|
389
|
+
<pre>
|
|
390
|
+
uris = r.uris(50,r.num(30))
|
|
391
|
+
</pre>
|
|
392
|
+
<p>
|
|
393
|
+
Which means that each row is the statistics collected as each request is
|
|
394
|
+
made from the 50 randomly generated URIs. If I were to write this out
|
|
395
|
+
it’d be:
|
|
396
|
+
</p>
|
|
397
|
+
<ol>
|
|
398
|
+
<li>Generate 50 random URIs.
|
|
399
|
+
|
|
400
|
+
</li>
|
|
401
|
+
<li>Request URIs 1-50, record how long each one takes.
|
|
402
|
+
|
|
403
|
+
</li>
|
|
404
|
+
<li>Average (with standard deviation) the times for each request.
|
|
405
|
+
|
|
406
|
+
</li>
|
|
407
|
+
<li>Store this as one "run".
|
|
408
|
+
|
|
409
|
+
</li>
|
|
410
|
+
<li>Repeat until all the runs are done.
|
|
411
|
+
|
|
412
|
+
</li>
|
|
413
|
+
</ol>
|
|
414
|
+
<p>
|
|
415
|
+
By doing this you cut down on the amount of information you need to analyze
|
|
416
|
+
to figure out if a server is behaving correctly. Instead of wading through
|
|
417
|
+
tons of data about each request, you just analyze the
|
|
418
|
+
"meta-statistics" about the runs.
|
|
419
|
+
</p>
|
|
420
|
+
<h3>Sample Runs Reduce Error</h3>
|
|
421
|
+
<p>
|
|
422
|
+
The reason for doing a series of runs and analyzing their standard
|
|
423
|
+
deviation (sd) and means is that it reduces the chance that one long run
|
|
424
|
+
was just done at the wrong time or in the wrong situation. If you just ran
|
|
425
|
+
a test once with the same settings every time you might not find out until
|
|
426
|
+
later that there was some confounding element which made the test invalid.
|
|
427
|
+
</p>
|
|
428
|
+
<h2>Source Code</h2>
|
|
429
|
+
<p>
|
|
430
|
+
The .tgz file (mentioned Downloading) has the source if you’re
|
|
431
|
+
interested. Remember that *you must have a rails app on 3000* for the tests
|
|
432
|
+
to run. Just a limitation right now until I hook Mongrel into the test
|
|
433
|
+
framework as the feedback loop.
|
|
434
|
+
</p>
|
|
435
|
+
<p>
|
|
436
|
+
You can also view <a
|
|
437
|
+
href="http://www.zedshaw.com/projects/rfuzz/coverage">www.zedshaw.com/projects/rfuzz/coverage</a>/
|
|
438
|
+
for the rcov generated coverage report which is also a decent source
|
|
439
|
+
browser.
|
|
440
|
+
</p>
|
|
441
|
+
|
|
442
|
+
</div>
|
|
443
|
+
|
|
444
|
+
|
|
445
|
+
</div>
|
|
446
|
+
|
|
447
|
+
|
|
448
|
+
</div>
|
|
449
|
+
|
|
450
|
+
|
|
451
|
+
<!-- if includes -->
|
|
452
|
+
|
|
453
|
+
<div id="section">
|
|
454
|
+
|
|
455
|
+
|
|
456
|
+
|
|
457
|
+
|
|
458
|
+
|
|
459
|
+
|
|
460
|
+
|
|
461
|
+
|
|
462
|
+
<!-- if method_list -->
|
|
463
|
+
|
|
464
|
+
|
|
465
|
+
</div>
|
|
466
|
+
|
|
467
|
+
|
|
468
|
+
<div id="validator-badges">
|
|
469
|
+
<p><small><a href="http://validator.w3.org/check/referer">[Validate]</a></small></p>
|
|
470
|
+
</div>
|
|
471
|
+
|
|
472
|
+
</body>
|
|
473
|
+
</html>
|