From f367728c4435670caf2e9cc5acad257e7766cc65 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Tue, 28 May 2019 16:40:24 +0200 Subject: afl++ 2.52c initial commit --- dictionaries/README.dictionaries | 43 ++ dictionaries/gif.dict | 18 + dictionaries/html_tags.dict | 160 +++++ dictionaries/jpeg.dict | 22 + dictionaries/js.dict | 107 +++ dictionaries/json.dict | 52 ++ dictionaries/pdf.dict | 1466 ++++++++++++++++++++++++++++++++++++++ dictionaries/png.dict | 38 + dictionaries/sql.dict | 282 ++++++++ dictionaries/tiff.dict | 51 ++ dictionaries/webp.dict | 20 + dictionaries/xml.dict | 72 ++ 12 files changed, 2331 insertions(+) create mode 100644 dictionaries/README.dictionaries create mode 100644 dictionaries/gif.dict create mode 100644 dictionaries/html_tags.dict create mode 100644 dictionaries/jpeg.dict create mode 100644 dictionaries/js.dict create mode 100644 dictionaries/json.dict create mode 100644 dictionaries/pdf.dict create mode 100644 dictionaries/png.dict create mode 100644 dictionaries/sql.dict create mode 100644 dictionaries/tiff.dict create mode 100644 dictionaries/webp.dict create mode 100644 dictionaries/xml.dict (limited to 'dictionaries') diff --git a/dictionaries/README.dictionaries b/dictionaries/README.dictionaries new file mode 100644 index 00000000..ea319733 --- /dev/null +++ b/dictionaries/README.dictionaries @@ -0,0 +1,43 @@ +================ +AFL dictionaries +================ + + (See ../docs/README for the general instruction manual.) + +This subdirectory contains a set of dictionaries that can be used in +conjunction with the -x option to allow the fuzzer to effortlessly explore the +grammar of some of the more verbose data formats or languages. The basic +principle behind the operation of fuzzer dictionaries is outlined in section 9 +of the "main" README for the project. + +Custom dictionaries can be added at will. They should consist of a +reasonably-sized set of rudimentary syntax units that the fuzzer will then try +to clobber together in various ways. Snippets between 2 and 16 bytes are usually +the sweet spot. + +Custom dictionaries can be created in two ways: + + - By creating a new directory and placing each token in a separate file, in + which case, there is no need to escape or otherwise format the data. + + - By creating a flat text file where tokens are listed one per line in the + format of name="value". The alphanumeric name is ignored and can be omitted, + although it is a convenient way to document the meaning of a particular + token. The value must appear in quotes, with hex escaping (\xNN) applied to + all non-printable, high-bit, or otherwise problematic characters (\\ and \" + shorthands are recognized, too). + +The fuzzer auto-selects the appropriate mode depending on whether the -x +parameter is a file or a directory. + +In the file mode, every name field can be optionally followed by @, e.g.: + + keyword_foo@1 = "foo" + +Such entries will be loaded only if the requested dictionary level is equal or +higher than this number. The default level is zero; a higher value can be set +by appending @ to the dictionary file name, like so: + + -x path/to/dictionary.dct@2 + +Good examples of dictionaries can be found in xml.dict and png.dict. diff --git a/dictionaries/gif.dict b/dictionaries/gif.dict new file mode 100644 index 00000000..71148937 --- /dev/null +++ b/dictionaries/gif.dict @@ -0,0 +1,18 @@ +# +# AFL dictionary for GIF images +# ----------------------------- +# +# Created by Michal Zalewski +# + +header_87a="87a" +header_89a="89a" +header_gif="GIF" + +marker_2c="," +marker_3b=";" + +section_2101="!\x01\x12" +section_21f9="!\xf9\x04" +section_21fe="!\xfe" +section_21ff="!\xff\x11" diff --git a/dictionaries/html_tags.dict b/dictionaries/html_tags.dict new file mode 100644 index 00000000..ba946df3 --- /dev/null +++ b/dictionaries/html_tags.dict @@ -0,0 +1,160 @@ +# +# AFL dictionary for HTML parsers (tags only) +# ------------------------------------------- +# +# A basic collection of HTML tags likely to matter to HTML parsers. Does *not* +# include any attributes or attribute values. +# +# Created by Michal Zalewski +# + +tag_a="" +tag_abbr="" +tag_acronym="" +tag_address="
" +tag_annotation_xml="" +tag_applet="" +tag_area="" +tag_article="
" +tag_aside="