matrix-fuzz

git clone git://archive.git.mtrnord.blog/MTRNord/matrix-fuzz.git
Log | Files | Refs | README | LICENSE

README.md (2114B)

      1 # Matrix Fuzzing
      2 
      3 Matrix fuzzing is a dumb fuzzer fuzzing a few matrix endpoints. It requires a HS and a user to exist.
      4 
      5 # Project room
      6 
      7 [#matrix-fuzz:midnightthoughts.space](https://matrix.to/#/#matrix-fuzz:midnightthoughts.space)
      8 
      9 # Current targets
     10 
     11 - `/_matrix/client/v3/createRoom` - `tests::tests::fuzz_create_room` - `createRoom`
     12 
     13 # Usage of fuzzcheck-rs
     14 
     15 1. Create a HS
     16 2. Setup a user
     17 3. Set `MATRIX_USERNAME` and `MATRIX_PASSWORD` to the username and password of the user you want to fuzz as.
     18 4. Install fuzzcheck -> https://github.com/loiclec/fuzzcheck-rs#setup
     19 5. Run `cargo fuzzcheck <target>`
     20 6. Wait until it crashes
     21 7. Verify the error by trying the output json yourself
     22 8. Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.
     23 
     24 # Usage of afl.rs
     25 
     26 1. Create a HS
     27 1. Setup a user
     28 2. Install afl.rs -> `cargo install afl`
     29 3. Run `cargo afl build`
     30 4. Set `MATRIX_USERNAME` and `MATRIX_PASSWORD` to the username and password of the user you want to fuzz as.
     31 5. Run `cargo afl fuzz -i ./afl/<target>/in -o ./afl/<target>/out ./target/debug/<target>`
     32 6. Wait until it crashes
     33 7. Verification is a little harder. See https://github.com/rust-fuzz/afl.rs/issues/215 on how to reproduce things
     34 8. Please make sure to follow https://matrix.org/security-disclosure-policy/ for found errors instead of posting them in public unless you are 100% sure they are not a security issue. If you are in doubt prefer the security disclosure policy.
     35 
     36 # Hall of Explosions (Bugs found)
     37 
     38 - https://github.com/matrix-org/synapse/issues/13510
     39 - https://github.com/matrix-org/synapse/issues/13511
     40 - https://github.com/matrix-org/synapse/issues/13512
     41 - https://github.com/matrix-org/synapse/issues/13664
     42 
     43 # Known bugs in the fuzzer
     44 
     45 The fuzzer generates arbitrary json objects currently very poorly. Resulting in a lot less cases than it should. Its a workaround for now until there is a nicer way.