<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-network-protocol-fuzzing
description: >-
  Fuzz network protocol implementations to discover vulnerabilities including buffer
  overflows, format string bugs, and state machine violations using boofuzz, Scapy,
  AFL-NET, and custom protocol fuzzers with crash monitoring and triage.
domain: cybersecurity
subdomain: network-security
tags:
  - fuzzing
  - protocol
  - boofuzz
  - scapy
  - vulnerability
  - crash-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1210", "T1203"]
  nist-csf: ["DE.CM-8", "ID.RA-1", "PR.IP-12"]
  uuid: a1b2c3d4-1012-4a00-b012-f00d00000012
---

# Performing Network Protocol Fuzzing

## Overview

Protocol fuzzing sends malformed, unexpected, or random data to network service
implementations to discover input validation failures, memory corruption, and logic bugs.
Effective fuzzing requires understanding the target protocol's state machine, defining
valid message templates, and monitoring for crashes, hangs, and unexpected behavior.
This skill covers boofuzz framework usage, Scapy-based custom fuzzers, crash triage,
and coverage-guided network fuzzing.

Mode: `[MODE: RED]` for vulnerability discovery; `[MODE: ARCHITECT]` for secure development testing.

## Prerequisites

| Requirement | Details |
|---|---|
| boofuzz Python fuzzing framework | Required |
| Scapy for custom packet crafting | Required |
| Target service in isolated lab environment | Required |
| GDB or ASAN-enabled builds for crash triage | Required |
| Suricata/Zeek for traffic monitoring during fuzzing | Required |
| Network capture (tcpdump) for reproducibility | Required |

## Key Concepts

### boofuzz Protocol Fuzzing

```python
#!/usr/bin/env python3
"""FTP protocol fuzzer using boofuzz framework."""

from boofuzz import Session, Target, SocketConnection, s_initialize, s_string, s_static, s_delim

def fuzz_ftp(target_host: str, target_port: int = 21) -> None:
    """Fuzz FTP server protocol implementation."""
    session = Session(
        target=Target(
            connection=SocketConnection(target_host, target_port, proto="tcp"),
        ),
        sleep_time=0.5,
        restart_sleep_time=2,
    )

    s_initialize("USER")
    s_static("USER ")
    s_string("anonymous", fuzzable=True, max_len=4096)
    s_static("\r\n")

    s_initialize("PASS")
    s_static("PASS ")
    s_string("guest@", fuzzable=True, max_len=4096)
    s_static("\r\n")

    s_initialize("CWD")
    s_static("CWD ")
    s_string("/", fuzzable=True, max_len=4096)
    s_static("\r\n")

    s_initialize("LIST")
    s_static("LIST ")
    s_string("*", fuzzable=True, max_len=4096)
    s_static("\r\n")

    session.connect(s_get("USER"))
    session.connect(s_get("USER"), s_get("PASS"))
    session.connect(s_get("PASS"), s_get("CWD"))
    session.connect(s_get("PASS"), s_get("LIST"))

    session.fuzz()
```

### Scapy Custom Protocol Fuzzer

```python
#!/usr/bin/env python3
"""Custom DNS fuzzer using Scapy for malformed packet generation."""

from scapy.all import IP, UDP, DNS, DNSQR, send, fuzz, RandShort, RandString

def fuzz_dns(target: str, port: int = 53, count: int = 1000) -> dict:
    """Send fuzzed DNS packets to target."""
    results = {"sent": 0, "errors": 0}
    for i in range(count):
        try:
            pkt = IP(dst=target) / UDP(dport=port, sport=RandShort()) / DNS(
                id=RandShort(),
                qr=0,
                opcode=i % 16,
                qd=DNSQR(
                    qname=RandString(size=i % 255),
                    qtype=i % 256,
                    qclass=i % 256,
                ),
            )
            send(pkt, verbose=0)
            results["sent"] += 1
        except Exception:
            results["errors"] += 1
    return results

def fuzz_tcp_handshake(target: str, port: int) -> dict:
    """Send malformed TCP packets with fuzzed options."""
    from scapy.all import TCP, Raw
    results = {"sent": 0}
    for flags in ["S", "SA", "F", "R", "P", "FSRPAU"]:
        pkt = IP(dst=target) / fuzz(TCP(dport=port, flags=flags)) / Raw(load=b"A" * 1024)
        send(pkt, verbose=0)
        results["sent"] += 1
    return results
```

### Monitoring Fuzzing Sessions

```bash
# Capture all fuzzing traffic for replay
tcpdump -i eth0 -w fuzzing_session.pcap host 10.0.0.50

# Monitor target service for crashes
# Watch process with GDB
gdb -p $(pidof target_service) -ex "set follow-fork-mode child" \
  -ex "handle SIGSEGV stop print" -ex "continue"

# Monitor with Suricata for unexpected responses
suricata -i eth0 -S /etc/suricata/rules/custom.rules -l /tmp/fuzz_monitor/

# Check for service availability during fuzzing
while true; do
  nmap -sV -p 21 10.0.0.50 --open -oG - | grep "open" || echo "SERVICE DOWN at $(date)"
  sleep 5
done
```

### Crash Triage

```bash
# Analyze core dumps
gdb /path/to/binary core.12345 -ex "bt full" -ex "info registers" -ex "quit"

# Check for ASAN output
grep -r "ERROR: AddressSanitizer" /var/log/target_service/

# Minimize crashing input
# Replay specific test case from boofuzz
python3 -c "
from boofuzz import *
session = Session(target=Target(connection=SocketConnection('10.0.0.50', 21, proto='tcp')))
# Replay case from crash database
"
```

### Nmap Script Fuzzing

```bash
# Use nmap NSE scripts to test protocol robustness
nmap --script=ftp-brute,ftp-vuln-cve2010-4221 -p 21 10.0.0.50
nmap --script=http-vuln* -p 80 10.0.0.50
nmap --script=smb-vuln* -p 445 10.0.0.50
```

## Workflow

### Step 1: Target Analysis

Identify protocol, parse specification, and map state machine.

### Step 2: Build Fuzz Harness

Define protocol message templates with fuzzable fields.

### Step 3: Configure Monitoring

Set up crash detection, traffic capture, and service monitoring.

### Step 4: Execute Fuzzing Campaign

```bash
# Run boofuzz with web interface
python3 fuzz_target.py &
# Monitor at http://localhost:26000
```

### Step 5: Triage Crashes

Analyze crash dumps, determine exploitability, and report findings.

## Detection

```yaml
title: Network Protocol Fuzzing Detection
id: 8fb5ccce-2574-4f45-baef-4fb813cc7485
status: experimental
description: Detects suspicious activity related to performing network protocol fuzzing techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1210
  - attack.t1203
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Protocol Fuzzing Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1210, T1203 |

## Verification

- [ ] Fuzzer covers all protocol commands/states
- [ ] Crash monitoring detects service failures
- [ ] Traffic captured for all fuzzing sessions
- [ ] Crashes triaged for exploitability
- [ ] Findings reported with reproduction steps
- [ ] Patches tested against original crash cases

## References

- [boofuzz Documentation](https://boofuzz.readthedocs.io/)
- [Scapy Documentation](https://scapy.readthedocs.io/)
- OWASP Fuzzing Guide
- MITRE ATT&CK T1190 — Exploit Public-Facing Application
