Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 457f6f2

Browse files
author
Daniele Linguaglossa
committed
added json generation via grammar
1 parent 44d3d2b commit 457f6f2

8 files changed

Lines changed: 128 additions & 5 deletions

File tree

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.1.1
1+
1.1.2

‎pyjfuzz/core/__init__.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,7 @@
2121
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
2222
SOFTWARE.
2323
"""
24+
import os
25+
26+
ROOT_PATH = "".join(x for x in __path__)
27+
GRAMMAR_PATH = "".join(x for x in __path__+ [os.sep, "pjf_grammar.py"])

‎pyjfuzz/core/pjf_configuration.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@
2929
from conf import CONF_PATH
3030
from argparse import Namespace
3131
from pjf_version import PYJFUZZ_LOGO
32+
from pjf_grammar import generate_json
33+
from . import GRAMMAR_PATH
3234
from errors import PJFInvalidType
3335

3436
class PJFConfiguration(Namespace):
@@ -40,6 +42,8 @@ def __init__(self, arguments):
4042
Init the command line
4143
"""
4244
super(PJFConfiguration, self).__init__(**arguments.__dict__)
45+
setattr(self, "generate_json", generate_json)
46+
setattr(self, "grammar_path", GRAMMAR_PATH)
4347
if self.json:
4448
if type(self.json) != dict:
4549
if type(self.json) != list:
@@ -93,6 +97,8 @@ def __init__(self, arguments):
9397
self.stdin = True
9498
if not self.parameters:
9599
self.parameters = []
100+
if self.auto:
101+
self.json = self.generate_json(self.grammar_path)
96102

97103
def __contains__(self, items):
98104
if type(items) != list:

‎pyjfuzz/core/pjf_grammar.py‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
"""
2+
The MIT License (MIT)
3+
4+
Copyright (c) 2016 Daniele Linguaglossa <[email protected]>
5+
6+
Permission is hereby granted, free of charge, to any person obtaining a copy
7+
of this software and associated documentation files (the "Software"), to deal
8+
in the Software without restriction, including without limitation the rights
9+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
copies of the Software, and to permit persons to whom the Software is
11+
furnished to do so, subject to the following conditions:
12+
13+
The above copyright notice and this permission notice shall be included in all
14+
copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
FITNESS FOR A PARTICULAR PURPOSE AND NON INFRINGEMENT. IN NO EVENT SHALL THE
19+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
SOFTWARE.
23+
"""
24+
from gramfuzz.fields import *
25+
import gramfuzz
26+
27+
def generate_json(path):
28+
grammar = gramfuzz.GramFuzzer()
29+
grammar.load_grammar(path)
30+
for x in grammar.gen(cat="json", num=10, max_recursion=10):
31+
if x not in ["{}", "[]"]:
32+
j = json.loads(x)
33+
del grammar
34+
return j
35+
return {"dummy": 1}
36+
37+
TOP_CAT = "json"
38+
39+
class RDef(Def): cat="json-def"
40+
41+
class RRef(Ref): cat="json-def"
42+
43+
Def("json",
44+
RRef("json-object") | RRef("json-array"),
45+
cat="json")
46+
47+
RDef("json-array",
48+
And("[",Join(RRef("value"), max=3, sep=","), "]") |
49+
And('[',Join(RRef("empty"), max=1), "]") |
50+
And('[',Join(RRef("json-array"), max=3, sep=","), "]")|
51+
And('[',Join(RRef("json-object"), max=3, sep=","), "]")
52+
)
53+
54+
RDef("key-value",
55+
56+
RRef("key") & ":" & RRef("value")
57+
58+
)
59+
60+
RDef("key-array",
61+
62+
RRef("key") & ":" & RRef("json-array")
63+
64+
)
65+
66+
RDef("key-object",
67+
68+
RRef("key") & ":" & RRef("json-object")
69+
70+
)
71+
72+
RDef("json-object",
73+
And("{", Join(RRef("key-value"), max=3, sep=","), "}") |
74+
And("{", Join(RRef("key-array"), max=3, sep=","), "}") |
75+
And("{", Join(RRef("key-object"), max=3, sep=","), "}") |
76+
And("{", RRef("empty"), "}")
77+
78+
)
79+
80+
RDef("key",
81+
Q(String(charset=String.charset_alphanum, min=5, max=10))
82+
)
83+
84+
RDef("sep",
85+
":"
86+
)
87+
88+
RDef("value",
89+
Int | Float | RRef("boolean") | RRef("key") | UInt | UFloat | RRef("null")
90+
)
91+
92+
RDef("empty",
93+
94+
""
95+
)
96+
97+
RDef("null",
98+
"null"
99+
)
100+
101+
RDef("boolean",
102+
Or("true", "false")
103+
)

‎pyjfuzz/core/pjf_version.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727

2828
PYJFUZZ_COMPANY = 'Mobile Security Lab 2016'
2929

30-
PYJFUZZ_VERSION = '1.1.1'
30+
PYJFUZZ_VERSION = '1.1.2'
3131

3232
PYJFUZZ_AUTHOR = "Daniele 'dzonerzy' Linguaglossa"
3333

‎pyjfuzz/core/pjf_worker.py‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,10 @@ def __init__(self, config):
4545
def browser_autopwn(self):
4646
try:
4747
from tools import TOOLS_DIR
48-
to_fuzz = {'lvl1': {"lvl2": [1, 1.0, "True"]}, "lvl1-1": [{"none": None, "inf": [{"a": {"a": "a"}}]}]}
48+
if not self.config.auto:
49+
to_fuzz = {'lvl1': {"lvl2": [1, 1.0, "True"]}, "lvl1-1": [{"none": None, "inf": [{"a": {"a": "a"}}]}]}
50+
else:
51+
to_fuzz = self.config.generate_json(self.config.grammar_path)
4952
run = "{0} http://127.0.0.1:8080/fuzzer.html".format(self.config.browser_auto)
5053
config = PJFConfiguration(Namespace(json=to_fuzz,
5154
html=TOOLS_DIR,
@@ -75,7 +78,10 @@ def browser_autopwn(self):
7578
def web_fuzzer(self):
7679
try:
7780
from tools import TOOLS_DIR
78-
to_fuzz = {'lvl1': {"lvl2": [1, 1.0, "True"]}, "lvl1-1": [{"none": None, "inf": [{"a": {"a": "a"}}]}]}
81+
if not self.config.auto:
82+
to_fuzz = {'lvl1': {"lvl2": [1, 1.0, "True"]}, "lvl1-1": [{"none": None, "inf": [{"a": {"a": "a"}}]}]}
83+
else:
84+
to_fuzz = self.config.generate_json(self.config.grammar_path)
7985
run = "{0} http://127.0.0.1:8080/fuzzer.html".format(self.config.browser_auto)
8086
config = PJFConfiguration(Namespace(json=to_fuzz,
8187
html=TOOLS_DIR,

‎pyjfuzz/pyjfuzz.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ def main():
4949
group.add_argument('--F', metavar='FILE', help='Path to file', type=pjf_configuration.PJFConfiguration.valid_file,
5050
default=None, dest="json_file")
5151

52+
group.add_argument('--auto', action='store_true', help='Automatically generate JSON init testcase', dest='auto',
53+
default=False)
54+
5255
parser.add_argument('-p', metavar='PARAMS', help='Parameters comma separated', required=False, dest="parameters")
5356

5457
parser.add_argument('-t', metavar='TECHNIQUES', help='Techniques "CHPTRSX"\n\n'

‎setup.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ def get_package_data():
6363
install_requires=[
6464
'bottle',
6565
'netifaces',
66-
'GitPython'
66+
'GitPython',
67+
'gramfuzz'
6768
],
6869
)
6970

0 commit comments

Comments
 (0)