FuzzPM

Differential Fuzzing for Perl Modules

---

Summary

This project aims to demonstrate how we can use the differential fuzzing technique to conduct security analysis in an automated and large-scale way to find security issues in modern components used by applications developed in Perl. Full publication is avaible on: https://heitorgouvea.me/2021/12/08/Differential-Fuzzing-Perl-Libs.

---

Download and install

# Download
$ git clone https://github.com/htrgouvea/fuzzpm && cd fuzzpm

# Install libs and dependencies
$ cpanm --installdeps .

---

How it works

Differential fuzzing is an approach where we have our seeds being sent to two or more inputs, where they are consumed and should produce the same output. At the end of the test these outputs are compared, in case of divergence the fuzzer will signal a possible failure [[1]].(https://en.wikipedia.org/wiki/Differential_testing)

So basically we have 3 components:

• Our targets;
• Input seeds;
• Test cases;

Here is a introduction about how you can create your own targets, seeds and test cases.

To create your entire fuzzing case, you first need to create your target library as a package, for example:

package Mojo_URI {
    use strict;
    use warnings;
    use Try::Tiny;
    use Mojo::URL;

    sub new {
        my ($self, $payload) = @_;

        try {
            my $url = Mojo::URL -> new($payload);
            
            return $url -> host;
        }

        catch {
            return undef;
        }
    }
}

Store at: ./targets/your-taget-name.pm.

So, you need store your seeds as a file at: ./seeds/your-seeds.txt. And the last part is your case as a YAML file, follow this structure:

test:
    seeds:
        - path/to/seeds-file.txt
    libs:
        - First_Target
        - Second_Target
        - Third_Target

For example, for our first case, the following YAML file was constructed and is supplied to the fuzzer via the parameter “--case”:

test:
    seeds:
        - seeds/urls-radamsa.txt
    libs:
        - Mojo_URI
        - Tiny_HTTP
        - Mojo_UA
        - Mechanize
        - Lib_Furl
        - Simple_URI

---

Fuzzing

$ perl fuzzpm.pl --case cases/json-decode.yml
$ perl fuzzpm.pl --case cases/parsing-url.yml

---

Docker container

$ docker build -t fuzzpm .
$ docker run -ti --rm fuzzpm --help

---

Contribution

Your contributions and suggestions are heartily ♥ welcome. See here the contribution guidelines. Please, report bugs via issues page and for security issues, see here the security policy. (✿ ◕‿◕)

---

License

This work is licensed under MIT License.