Hot Fuzz with Latest Peach?

[Anton Bogdan]

Hi,

I recently learned about this project and I am super excited about. Can you please tell me if Hot Fuzz still works with the latest 3.0 version release of Peach? Are there any changes that are required.

Your response will be appreciated.

Anton

[antonv...@gmail.com]

Let me get a bit more specific on my question above as well as add some additional questions. I think HotFuzz would work great for a current project. However, I am having a hard time figuring out the answer to a couple of questions that would help me know for sure. I have a client / sever network protocol I would like to test. Here are the requirements:

• Client / Server System can't all be run together on one computer with HotFuzz installed. There will be three system: Client System, Server System, and Hot Fuzz System. Operating Systems for Client / Server not yet known. Likely windows.
  
• What does this mean I have to install on the client / server systems in order to get them to work properly with the Hot Fuzz system?
• Do I just have to install the Peach Agents? Do I have to install the complete Peach Framework?
• If the version is different  from what the Hot Fuzz application is using is this ok? For example, could I install a newer version (e.g. Peach 3.0) and have it still work?
• This would be great if this is the case because it seems like Peach 3.0 has better support for non-windows operating systems. I'm not sure what operating systems my client and server machines will be yet.
  
• If I have to install the agents or the peach framework can I simply just point the the agent listeners input boxes in the user interface to the ip addresses of the system and then everything works like the demo? Any guidance would be appreciated.
  
• Custom Procotol. What if the protocol I am testing is custom and doesn't have a wireshark dissector? I am almost positive the protocol will not be well known. Would I just define in it in a peach file as I go? Would I write a wireshark dissector I drop on my Hot Fuzz environment? What is the easiest way?
  

Any help from someone knowledgeable would be appreciated. Thanks!

[Mgr. Martin Žember]

Hi,

thanks for asking.

The source code of HotFuzz and Peach is tied in a way that upgrading within 2.3 versions is still possible, but I guess with the 3.0 it will not be possible without reprogramming all of HotFuzz. I do not know the details about Peach 3 (except that it has been rewritten in .NET) and Peach 2.3.x was in Python. That explains why I guess so.

Whether the Agents are compatible, I do not know. It is an interesting question. Maybe someone else can answer. If yes, it would make it more usable cross-platform.

If there is not a dissector for your protocol, half of the advantages of using HotFuzz is gone. It will probably see the data as a binary blob. The remaining advantage is that it uses a real client and a real server; if you would have to describe a lot of different states the programs can be in, then using HotFuzz would still be reasonable. Otherwise, writing a PIT file would be probably easier.

One thing you might consider is that if the dissector could be useful for others in the future, you would help them if you wrote it :-)

Martin

--
 
---
You received this message because you are subscribed to the Google Groups "HotFuzz project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to hotfuzz-proje...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

[antonv...@gmail.com]

As I understand it, the use of HotFuzz increases the ease of the following two more manual aspects of peach when network fuzzing:

1. State Model
2. Data Model

From your responses it appears the data model is only useful if a wireshark dissector is available in the wireshark installed with HotFuzz. Otherwise, the data is will simply be presented as a blob. The automatic state modeling feature would still be present. Two follow-up questions:

1. If I use HotFuzz for the state modeling feature for an unknown protocol, can I manual model the data for the data model in an xml file or something like that? How could this be done? Is the only way to model the data is with a wireshark dissector?
2. If I created a wireshark dissector for the custom protocol, how could I add it for use with HotFuzz? 
   

Thanks.

On Saturday, November 2, 2013 12:17:32 PM UTC-6, Anton Bogdan wrote: