# fuzzer
A quick little fuzzer for detecting issues within each of the five context areas.
# How it works
The fuzzer creates testcases by mutating entries within [bin/seed.xss](bin/seed.xss). The entries are then stored into redis as:
```
redis:
testcases:1 -> ">"
testcases:2 -> "alert(1)"
testcases:3 -> "`'`;';`alert(1)"
testcases_counter: 4
```
The fuzzer then spawns a headless browser (zombie.js), which requests the newly created test case. An example page would be localhost:1339/testcase/3
The web server loads the payload from redis, and serves the following html page:
```html
Fuzz Test!
xssFilters.inHTMLData(fuzz)
xssFilters.inHTMLData(fuzz)
xssFilters.inHTMLComment(fuzz)
" +
xssFilters.inSingleQuotedAttr(fuzz)
xssFilters.inDoubleQuotedAttr(fuzz)
xssFilters.inUnQuotedAttr(fuzz)
```
If the headless browser detects anything (console.logs, xhr, redirects), it stores that testcase in redis:injections
# To Run
First you must install Redis. There's plenty of resources on how to do this.
You also need a more recent version of Node to use zombie.js. I'm using version v0.12.2.
First you start the server:
```
$ pwd
~/xss-filters/tests/fuzz
$ node app.js
```
Then run a bunch of fuzzers:
```
$ node --harmony bin/fuzzer.js
```
To check the results:
```
$ redis
> get testcases_counter
"3391770"
> smembers injections
(empty list or set)
```
Which means I have no results yet.
Enjoy!
## Contact
stuartlarsen@yahoo-inc.com