Simple FTP Fuzzer – Metasploit Module
If you want to show your respect for my free tools and free support, please consider a small donation :
Download :
FTP Fuzzer - Metasploit Module (6.0 KiB)
Update (July 2010) : the ftp fuzzer has been merged into the Metasploit tree. You do no longer need to download the script here. If you are using the latest version of Metasploit (svn update), then you can find the fuzzer in the modules/auxiliary/fuzzers/ftp folder (file is called ftp_pre_post.rb.
Usage :
Navigate to the metasploit folder, go into ‘modules’ and then into ‘auxiliary’
Create a subfolder called ‘fuzzer’ and place the fuzz_ftp.rb file in that folder
Open Metasploit console and select the module
_ _
_ | | (_)_
____ ____| |_ ____ ___ ____ | | ___ _| |_
| \ / _ ) _)/ _ |/___) _ \| |/ _ \| | _)
| | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__
|_|_|_|\____)\___)_||_(___/| ||_/|_|\___/|_|\___)
|_|
=[ msf v3.3-dev [core:3.3 api:1.0]
+ -- --=[ 429 exploits - 261 payloads
+ -- --=[ 21 encoders - 8 nops
=[ 199 aux
msf > use auxiliary/fuzzer/fuzz_ftp
msf auxiliary(fuzz_ftp) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
DELAY 0.5 no Delay between connections
ENDSIZE 20000 no Fuzzing string endsize
PASS anonymous@test.com no Password
RHOSTS yes The target address range or CIDR identifier
RPORT 21 yes The target port
STARTATSTAGE 1 no Start at this test stage
STARTSIZE 10 no Fuzzing string startsize
STEPSIZE 10 no Increase string size each iteration with this number of chars
THREADS 1 yes The number of concurrent threads
USER anonymous no Username
msf auxiliary(fuzz_ftp) >
Important options are :
RHOSTS = the ip address of the FTP server
USER and PASS = set to a valid/working Username & Password combination
The fuzzer has 5 stages :
- Issue no command, only send evil data
- Fuzz the USER command
- Fuzz the PASS command (after a valid USER command/login was executed)
- Fuzz all FTP commands (after a valid login was performed), one command, one fuzz string per session
- Fuzz all FTP commands (after a valid login was performed), one command with all fuzz combinations for that command per session
You can edit the fuzz data and FTP commands yourself (if you want to) by editing the fuzz_ftp.rb file
Start fuzzing ? Just issue the ‘run’ command. When the fuzzer cannot connect anymore, the fuzzing process will be halted, and the last sent string will be displayed.
One Response to Simple FTP Fuzzer – Metasploit Module
Donate
Your donation will help funding server hosting.
Leave a Reply