Results 1 to 6 of 6

Thread: Configuring and Using SPIKE

  1. #1
    Join Date
    2014-Aug
    Posts
    7

    Configuring and Using SPIKE

    So I started a project to Fuzz applications. I am using Spike for beginners but unfortunately their is not much documentation on SPIKE out there. Can anyone provide any good documentation on how to configure and use spike? Much appreciated!

  2. #2
    Join Date
    2013-Apr
    Location
    Kali forums
    Posts
    805
    One of the best spike resources I've seen was a series of tutorials by Stephen Bradshaw at http://resources.infosecinstitute.com/author/lupin/ I'd go through these from the bottom-up.

    There's a talk at SkyDogCon (October 24) on fuzzing basics that will cover spike...full disclosure, I'm the speaker

  3. #3
    Join Date
    2015-Dec
    Posts
    2
    Hello, I'm currently working on fuzzing a old, buggy program and through some research I discovered a buffer overflow vuln on an argument of a particular command. What I cannot figure out is how to configure spike to send a fuzz string to the second argument only (send a static, fixed length variable for the first argument, then send fuzz data to the second argument). The arguments are separated by a space, is there a way to set a constant for the first argument, append a space and fuzz everything after the constant & space? I believe the option may be available by using "s_string_variables" and SKIPVAR, or possibly some proper spike scripting on my part but I've never reconfigured Spike this way. Any help is greatly appreciated!
    Last edited by padawan; 2016-02-27 at 23:48.

  4. #4
    Join Date
    2013-Apr
    Location
    Kali forums
    Posts
    805
    s_string sends a constant, while s_string_variable sends a constant on the first run, then fuzzed data on subsequent runs. You could break up your command like so...

    s_string("PUT ");
    s_string("constant ");
    s_string_variable("fuzzed_data");


    When combined by spike, the first result will look like this (note the spaces after the PUT and constant):
    PUT constant fuzzed_data

    The next run will look like this (again note the spaces after the PUT and constant):
    PUT constant [fuzz string inserted by spike]

    Hope this helps

  5. #5
    Join Date
    2013-Apr
    Location
    Kali forums
    Posts
    805
    Also, you may want to check out my github page at https://github.com/griddd/SDC2015

    The .spk files are for spike.

  6. #6
    Join Date
    2015-Dec
    Posts
    2
    Thanks for the info!
    Last edited by padawan; 2016-02-27 at 23:46.

Similar Threads

  1. Configuring keyboard layout?
    By Tod in forum General Archive
    Replies: 5
    Last Post: 2017-09-04, 13:30
  2. Configuring Azure image
    By a8ree in forum General Archive
    Replies: 0
    Last Post: 2016-11-02, 08:49
  3. location of spike source?
    By grid in forum TroubleShooting Archive
    Replies: 2
    Last Post: 2015-10-27, 15:01

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •