Skip to content

Instantly share code, notes, and snippets.

@DinisCruz
Created August 15, 2013 22:14
Show Gist options
  • Select an option

  • Save DinisCruz/6245464 to your computer and use it in GitHub Desktop.

Select an option

Save DinisCruz/6245464 to your computer and use it in GitHub Desktop.
//O2Include:PoC - Fuzzing Images.h2
var baseFolder = @"C:\Users\o2\AppData\Roaming\OWASP_O2_Platform_5.3\8_15_2013";
var sourceFolder = baseFolder.pathCombine("badImages_Ico");
//maxItems = 10;
fuzzFromFolder(sourceFolder);
return "done";
//O2Include:PoC - Fuzzing Images.h2
var baseFolder = @"C:\Users\o2\AppData\Roaming\OWASP_O2_Platform_5.3\8_15_2013";
var sourceFolder = baseFolder.pathCombine("badImages_Png");
//maxItems = 10;
fuzzFromFolder(sourceFolder);
return "done";
var topPanel = "Fuzz Image in IE".popupWindow(1200,800);
var maxItems = -1;
var browser = topPanel.add_WebBrowser_Control();
Action<string> fuzzFromFolder =
(folder)=>{
var images = folder.files().take(maxItems);
var count = 0;
var total = images.size();
var htmlTemplate = @"<html><body><h1>{0}</h1>
<h2>[{1}/{2}]</h2>
<img src='{0}'/>
<img src='{0}' width='10'/>
<img src='{0}' width='100'/>
<img src='{0}' width='500'/>
</body></html>";
foreach(var image in images.take(-1))
{
var html = htmlTemplate.format(image,++count,total);
browser.set_Html(html);
}
};
//var topPanel = "{name}".popupWindow(700,400);
var topPanel = panel.clear().add_Panel();
var file = @"O2Logo_Small.gif".local();
//var file = @"Clojure-icon.png".local();
//var file = @"blogs-stack.ico".local();
var fileType = file.extension().removeFirstChar();
var generateAllBytes = false;
var forceGeneration = false;
var targetFolder = "badImages_{0}_{1}".format(fileType,generateAllBytes).tempDir(false);
targetFolder.startProcess();
var bytes = file.fileContents_AsByteArray();
var createdFiles = 0;
var skippedFiles = 0;
Action<int,byte> generateFile =
(pos,value)=>{
var clone = bytes.clone();
clone[pos] = value;
var fileName = "Fuzz_{0}_{1}_{2}.{0}".format(fileType,pos, value);
var fullPath = targetFolder.pathCombine(fileName);
if (forceGeneration.isFalse() && fullPath.fileExists())
skippedFiles++;
else
{
clone.saveAs(fullPath);
createdFiles++;
}
};
for(var i = 1 ; i < bytes.size() ; i++)
{
if (generateAllBytes)
{
for(var j=0 ; j < 256 ; j++)
generateFile(i,(byte)j);
}
else
{
generateFile(i,0x00);
generateFile(i,0x22);
generateFile(i,0x66);
generateFile(i,0xA0);
generateFile(i,0xFF);
}
}
return "{0} - {1}".format(createdFiles , skippedFiles);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment