oauzz – The fuzzer for OAuth based applications

OAuzz is a fuzzer which allows to check the security of OAuth based web services. It has been implemented based on RFC 5849 and on OAuth Request Body Hash 1.0 Draft 4.
OAuzz supports the three signature algorithms of OAuth 1.0 (PLAINTEXT, HMAC-SHA1 and RSA-SHA1) and implements the extra OAuth parameter oauth_body_hash to allow integrity checks on HTTP request bodies with content types other than application/x-www-form-urlencoded.

How to fuzz
The variables marked as fuzzable can be fuzzable (obviously).

To fuzz them, they have to be setted up using the word “FUZZ” wherever you want to fuzz.

The following example will fuzz the variable BODY in two different points:
OAuzz > set BODY param1=FUZZ¶m2;=FUZZ¶m3;=this_is_not_fuzzable
Set the original value for FUZZ pattern 1: fuzzable_value_1
Set the original value for FUZZ pattern 2: fuzzable_value_2
BODY = param1=fuzzable_value_1¶m2;=fuzzable_value_2¶m3;=this_is_not_fuzzable
OAuzz > show BODY
BODY = param1=FUZZ¶m2;=FUZZ¶m3;=this_is_not_fuzzable
OAuzz >

Usage Example
OAuzz supports input scripts, so you can write your own scripts using the OAuzz syntax to launch your tests automatically.

One script example is the file ‘script.txt’:
# Configure a proxy

# Set the application credentials
set CONSUMERKEY myConsumerKey
set CONSUMERSECRET myConsumerSecret

# Set the user credentials
set TOKENKEY myUserToken
set TOKENSECRET myUserSecret

# Set the URL to fuzz
set URL “https://www.example.com/getProfile/user:FUZZ”

# Launch the fuzzer

The way to call OAuzz with an input script (you can put as many as you want) is:
$ python OAuzz_v1.0.py script.txt

Download : OAuzz_v1.0.py (94.9 KB)
Find Other version |
read more in here : http://laxmarcaellugar.blogspot.com/