# Proxyfuzz: a TCP and UDP proxy man-in-the-middle fuzzer
# v 0.1
# By Rodrigo Marcos
# http://www.theartoffuzzing.com
 
from twisted.protocols import portforward
from twisted.internet.protocol import DatagramProtocol
from twisted.internet import reactor
import getopt, sys
from random import randint
 
 
# UDP Proxy stuff
 
class Client(DatagramProtocol):
	def __init__(self, server, host, port):
		self.server = server
		self.host = host
		self.port = port
 
	def startProtocol(self):
		self.transport.connect(desthost, destport)
 
	def datagramReceived(self, data, (host, port)):
		global verbose
		global notuntil
		global request
		global testclient
 
		if testclient:
			if request < notuntil:
				request = request + 1
			else:
				data = fuzz(data)
		if verbose:
			print "Server ------> Client"
			print "%r" % data
 
	        self.server.transport.write(data, (self.host, self.port))
 
class Server(DatagramProtocol):
	client = None
 
	def datagramReceived(self, data, (host, port)):
		if not self.client or self.client.host != host or self.client.port != port:
			self.client = Client(self, host, port)
			reactor.listenUDP(0, self.client)
 
		global verbose
		global notuntil
		global request
		global testserver
 
		if testserver:
			if request < notuntil:
				request = request + 1
			else:
				data = fuzz(data)
		if verbose:
			print "Client ------> Server"
			print "%r" % data 
		self.client.transport.write(data, (desthost, destport))
 
# TCP proxy stuff
 
def server_dataReceived(self, data):
	global verbose
	global notuntil
	global request
	global testserver
 
	if testserver:
		if request < notuntil:
			request = request + 1
		else:
			data = fuzz(data)
 
	if verbose:
		print "Client ------> server"
		print "%r" % data
 
	portforward.Proxy.dataReceived(self, data)
 
portforward.ProxyServer.dataReceived = server_dataReceived
 
def client_dataReceived(self, data):
	global verbose
	global notuntil
	global request
	global testclient
 
	if testclient:
		if request < notuntil:
			request = request + 1
		else:
			data = fuzz(data)
	if verbose:
		print "Server ------> Client"
		print "%r" % data
 
	portforward.Proxy.dataReceived(self, data)
 
portforward.ProxyClient.dataReceived = client_dataReceived
 
 
overflowstrings = ["A" * 255, "A" * 256, "A" * 257, "A" * 420, "A" * 511, "A" * 512, "A" * 1023, "A" * 1024, "A" * 2047, "A" * 2048, "A" * 4096, "A" * 4097, "A" * 5000, "A" * 10000, "A" * 20000, "A" * 32762, "A" * 32763, "A" * 32764, "A" * 32765, "A" * 32766, "A" * 32767, "A" * 32768, "A" * 65534, "A" * 65535, "A" * 65536, "%x" * 1024, "%n" * 1025 , "%s" * 2048, "%s%n%x%d" * 5000, "%s" * 30000, "%s" * 40000, "%.1024d", "%.2048d", "%.4096d", "%.8200d", "%99999999999s", "%99999999999d", "%99999999999x", "%99999999999n", "%99999999999s" * 1000, "%99999999999d" * 1000, "%99999999999x" * 1000, "%99999999999n" * 1000, "%08x" * 100, "%%20s" * 1000,"%%20x" * 1000,"%%20n" * 1000,"%%20d" * 1000, "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"]
 
def bitflipping(data):
	l = len(data)
	n = int(l*7/100) # 7% of the bytes to be modified
 
	for i in range(0,n): # We change the bytes
		r = randint(0,l-1)
		data = data[0:r] + chr(randint(0,255)) + data[r+1:]
	return data
 
def bofinjection(data):
	l = len(data)
	r = randint(0,len(overflowstrings)-1)
	data = data[0:r] + overflowstrings[r] + data[r-l:]
	return data
 
def fuzz(data):
 
	r = randint(0,5)
	if r==0:
		data = bitflipping(data)
 
	r = randint(0,5)
	if r==0:
		data = bofinjection(data)
	return data
 
def startudpproxy():
	reactor.listenUDP(localport, Server())
	reactor.run()
 
def starttcpproxy():
	reactor.listenTCP(localport, portforward.ProxyFactory(desthost, destport))
	reactor.run()
 
def usage():
	#print "###############################################################"
	print
	print "ProxyFuzz 0.1, Simple fuzzing proxy by Rodrigo Marcos"
	print "http://www.theartoffuzzing.com"
	print
	print "usage():"
	#print
	print "python proxyfuzz -l <localport> -r <remotehost> -p <remoteport> [options]"
	print
	print " [options]"
	print "		-c: Fuzz only client side (both otherwise)"
	print "		-s: Fuzz only server side (both otherwise)"
	print "		-w: Number of requests to send before start fuzzing"
	print "		-u: UDP protocol (otherwise TCP is used)"
	print "		-v: Verbose (outputs network traffic)"
	print "		-h: Help page"
 
 
verbose = False
notuntil = 0
request = 0
proto = "tcp"
localport = 0
desthost = ""
destport = 0
testclient = 1
testserver = 1
def main():
	global verbose
	global notuntil
	global proto
	global localport
	global desthost
	global destport
	global testclient
	global testserver
 
	try:
		opts, args = getopt.getopt(sys.argv[1:], "uvhcsl:r:p:w:", ["help"])
	except getopt.GetoptError:
		usage()
		sys.exit(2)
	try:
		for o, a in opts:
			if o in ("-h", "--help"):
				usage()
				sys.exit()
			if o == "-l":
				localport=int(a)
			if o == "-r":
				desthost=a
			if o == "-p":
				destport=int(a)
			if o == "-v":
				verbose = True
			if o == "-w":
				notuntil=int(a)
			if o == "-u":
				proto="udp"
			if o == "-c": # Only client
				testserver=0
			if o == "-s": # Only server
				testclient=0
 
 
	except:
		usage()
		sys.exit(2)
 
	if testserver==0 and testclient==0:
		usage()
		sys.exit(2)
	elif localport==0 or desthost=="" or destport==0:
		usage()
		sys.exit(2)
	else:
		if proto=="tcp":
			starttcpproxy()
		else: # UDP
			startudpproxy()
 
if __name__ == "__main__":
    main()