| name | boofuzz |
| description | Auth/lab ref: Python network protocol fuzzing framework (Sulley successor). For stateful TCP/UDP protocol fuzzing, request-graph modeling, monitor-driven crash detection, and reproducible protocol campaign workflows. |
| license | GPL-2.0 |
| compatibility | Python 3 on Linux/Windows/macOS. |
| metadata | {"author":"GitHub Copilot","version":"1.1"} |
boofuzz
Protocol fuzzer framework with request modeling, session graphs, monitors, and structured logging.
Quick Start
pip install boofuzz
from boofuzz import Session, Target, TCPSocketConnection, s_initialize, s_string, s_get
s_initialize("req")
s_string("HELLO", fuzzable=True)
session = Session(target=Target(connection=TCPSocketConnection("127.0.0.1", 9999)))
session.connect(s_get("req"))
session.fuzz()
Operator Flow (Recommended)
- Define protocol requests as
Request + Block + primitives.
- Build realistic session graph via
session.connect(...).
- Add monitors (process/network/callback) before scaling testcases.
- Enable logs and reproduce individual failing testcases from run DB.
- Iterate on protocol model quality (field sizes, delimiters, checksums, dependencies).
Best Use Cases
- Custom/legacy network protocols.
- Stateful handshake + multi-step message flows.
- Harnesses requiring explicit restart/monitor logic.
Practical Tricks
- Use
post_test_case_callbacks for protocol-aware checks instead of only crash/no-crash signals.
- Use
ProtocolSessionReference when later messages need dynamic data extracted from prior responses.
- Keep a strict separation between:
- transport connection behavior,
- protocol message modeling,
- health/monitoring logic.
- Prefer deterministic target reset routines in monitor hooks.
Common Pitfalls
- Blind mutation of raw bytes without block/field modeling wastes boofuzz strengths.
- No monitor/restart chain -> flaky crash attribution.
- Overly broad callback side effects -> non-deterministic failures.
Logging & Triage
- Use text/CSV/curses loggers via
FuzzLogger multiplexer for both operator visibility and artifacts.
- Persist each run DB (
boofuzz-results/run-*.db) and reopen for post-campaign review.
- Keep concise crash synopsis in monitor implementations (
get_crash_synopsis).
Resources
