simple netflowv9 fuzzer

flow_fuzz.py

from sulley import *
from requests import ipfix


sess = sessions.session(session_filename='audits/ipfix.session',proto="udp",log_level=1,sleep_time=0.1)

target = sessions.target('1.2.3.4',2055)
target.netmon = pedrpc.client('127.0.0.1',26001)
sess.add_target(target)
# sess.connect(s_get("flowheader"))
# sess.connect(s_get("flowheader"),s_get("flowtemplate"))
# sess.connect(s_get("flowtemplate"),s_get("flowdata"))
sess.connect(s_get("flow"))
sess.fuzz()

ipfix.py

from sulley import *


IP_SRC_ADDR=8
IP_DST_ADDR=12
IP_NEXT_HOP=15
INPUT_SNMP=10
OUTPUT_SNMP=14
PKTS=2
BYTES=1
L4_SRC_PORT=7
L4_DST_PORT=11
TCP_FLAGS=6
PROTOCOL=4 # len 1
IP_TOS=5  # len 1
DST_AS=17	#len 2
SRC_AS=16	# len 2
SRC_MASK=9	# len 1
DST_MASK=13	#len 1
LAST_SWITCHED=21
FIRST_SWITCHED=22


s_initialize("flow")
# s_initialize("flowheader")
s_static("\x00\x09", name="version")	# Version
s_byte("\x02") # Number of FlowSets. We set to 2 - 1 is template, 2 is data
s_dword(30784994, name="sysuptime")
s_dword(0,name="currentSecs")
s_random("\x00\x00\x0c\x59",4,4,name="flowsec") # FlowSeq - should be probably ever increasing
s_dword(0)  # sourceid

# s_initialize("flowtemplate")
if s_block_start("flowset1"):
	s_static("\x00",name="flowsetid_0")
	s_sizer("flowset1",fuzzable=True)
	s_short(300) # template ID
	s_short(18)  # field count
	# field
	s_int(IP_SRC_ADDR,name="IP_SRC_ADDR_type")
	s_short(4,name="IP_SRC_ADDR_len")
	s_int(IP_DST_ADDR,name="IP_DST_ADDR_type")
	s_short(4,name="IP_DST_ADDR_len")
	s_int(IP_NEXT_HOP,name="IP_NEXT_HOP_type")
	s_short(4,name="IP_NEXT_HOP_len")
	s_int(INPUT_SNMP,name="INPUT_SNMP_type")
	s_short(4,name="INPUT_SNMP_len")
	s_int(OUTPUT_SNMP,name="OUTPUT_SNMP_type")
	s_short(4,name="OUTPUT_SNMP_len")
	s_int(PKTS,name="PKTS_type")
	s_short(4,name="PKTS_len")
	s_int(BYTES,name="BYTES_type")
	s_short(4,name="BYTES_len")
	s_int(L4_SRC_PORT,name="L4_SRC_PORT_type")
	s_short(4,name="L4_SRC_PORT_len")
	s_int(L4_DST_PORT,name="L4_DST_PORT_type")
	s_short(4,name="L4_DST_PORT_len")
	s_int(TCP_FLAGS,name="TCP_FLAGS_type")
	s_short(4,name="TCP_FLAGS_len")
	s_int(PROTOCOL,name="PROTOCOL_type")
	s_short(1,name="PROTOCOL_len") # len 1
	s_int(IP_TOS,name="IP_TOS_type")
	s_short(1,name="IP_TOS_len")	# len 1
	s_int(DST_AS,name="DST_AS_type")
	s_short(2,name="DST_AS_len")	#len 2
	s_int(SRC_AS,name="SRC_AS_type")
	s_short(2,name="SRC_AS_len")	# len 2
	s_int(SRC_MASK,name="SRC_MASK_type")
	s_short(1,name="SRC_MASK_len")	# len 1
	s_int(DST_MASK,name="DST_MASK_type")
	s_short(1,name="DST_MASK_len")	#len 1
	s_int(LAST_SWITCHED,name="LAST_SWITCHED_type")
	s_short(4,name="LAST_SWITCHED_len")
	s_int(FIRST_SWITCHED,name="FIRST_SWITCHED_type")
	s_short(4,name="FIRST_SWITCHED_len")
s_block_end("flowset1")
# s_initialize("flowdata")
if s_block_start("flowset2"):
	s_word(300,name="flowsetid_300")
	s_size("flowset2",fuzzable=True)
	s_dword("\x08\x08\x08\x08",name="srcaddr")
	s_dword("\x09\x09\x09\x09",name="dstaddr")
	s_dword("\x00\x00\x00\x00",name="nexthop")
	s_short(3,name="inputint")
	s_short(5,name="outputint")
	s_dword(1,name="packets")
	s_dword(40,name="octets")
	s_short(4242,name="srcport")
	s_short(80,name="dstport")
	s_byte("\x00",name="tcpflags")
	s_byte("\x06",name="protocol") # 6 - tcp
	s_byte("\x01",name="iptos")
	s_word(3,name="dstas")
	s_word(2,name="srcas")
	s_byte(32,name="srcmask")
	s_byte(31,name="dstmask")
	s_dword("\x01\xd5\xba\x73",name="endtime")
	s_dword("\x01\xd4\xd0\x13",name="starttime")
	s_static("\x00\x00\x00",name="padding")
s_block_end("flowset2")