Network Security slide set

## HTML & CSS

```
<!doctype html>
<html>
  <head>
    <title>Basic page</title>
    <link rel="stylesheet" href="style.css">
    <script src="scripts.js"></script>
  </head>
  <body>
    <p>Hello world!</p>
  </body>
</html>
```

```
body {
  background-color: rgb(80,130,190);
}
p { 
  text-align: justify;
  text-decoration: underline;
}
```

## Javascript
- Code that can run at any time
  - When a page is loaded, a widget is pressed, based on a timer, etc.
- And can load *dynamic content*
  - Via the `XMLHttpRequest()` function:
    - Can load data from server, send data back, etc.

## Web Servers
<img src='http://www.cs.virginia.edu/~asb2t/duimg/n21/image5.png' height='300px'>

```
<VirtualHost *:80>
    DocumentRoot /var/www/html/
</VirtualHost>
<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example.com/
</VirtualHost>
```

## Web Applications
- The web *server* (not the client) has to run programs
  - In a sandbox, of course
- Three methods:
  - CGI: older standard, creates (and destroys) a process for *each* web page view; slow
  - FastCGI: upgrade to CGI, re-uses processes
  - Modules: a library loaded into Apache2
    - mod_php: PHP code support
    - mod_wsgi or mod_asgi: for Python, including Django support
    - mod_passenger: for Ruby (and Ruby on Rails)
    - Others exist for perl, C/C++, Fortran (!), etc.

## HTTP Protocol
[![](https://developer.mozilla.org/en-US/docs/Web/HTTP/Messages/httpmsgstructure2.png)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Messages)
- We've seen this in the [TCP Reconstruction homework](../hws/tcprecon/index.html)

## GET versus POST
- GET:
```
GET /path/to/index.php?userid=mst3k&which=1&value=no  HTTP/1.1
Host: www.example.com
...
```
- POST:
```
POST /path/to/index.php HTTP/1.1
Host: www.example.com
...
userid=mst3k & which=1 & value=no
```

## Cookies & Sessions
[![](https://upload.wikimedia.org/wikipedia/commons/thumb/7/71/Christmas_Cookies_Plateful.JPG/1024px-Christmas_Cookies_Plateful.JPG)](https://commons.wikimedia.org/wiki/File:Christmas_Cookies_Plateful.JPG)
- Technically, HTTP connections are *stateless*
- The way it keeps state is via cookies
  - Key-value pairs stored in your browser
- Set in the HTTP *response*:
```
HTTP/1.0 200 OK
Content-type: text/html
Set-Cookie: name=Chris
Set-Cookie: account=123456
```
- Often will be a random or hashed value
  - Lookup in a database or hashed from the info available to the server

## Cookies & Sessions
[![](https://upload.wikimedia.org/wikipedia/commons/thumb/5/50/Chocolate_chip_cookies.jpg/1024px-Chocolate_chip_cookies.jpg)](https://commons.wikimedia.org/wiki/File:Chocolate_chip_cookies.jpg)
- Future HTTP requests include that cookie:
```
GET /account.html HTTP/1.1
Host: www.example.com
Cookie: name=Chris; account=123456
```
- Same Origin Policy: cookies can only be read by the *same* domain that wrote them
  - (and the same port and protocol)

## Tracking cookies

![](http://www.cs.virginia.edu/~asb2t/duimg/n21/image17.png)
- You go to store_1.com
  - That site includes an add (or script) from doubleclick.net
- doubleclick.net serves the add (or script or whatever)
  - It receives a referrer field, so knows you were at shopping_site_1.com
  - And it stores a cookie that only it can read
- You then go to store_2.com
  - Now doubleclick.net knows both sites you've been to
- And the data is sold back and forth by data brokers

## Session Cookies
[![](https://upload.wikimedia.org/wikipedia/commons/thumb/3/3a/Biscotti_artgianali_Siracusa.jpg/1024px-Biscotti_artgianali_Siracusa.jpg)](https://commons.wikimedia.org/wiki/File:Biscotti_artgianali_Siracusa.jpg)
- aka Session Variables, aka Sessions
  - Very similar to server variables
- A cookie stored on the *server*
- It's provided to the browser as information
- Example: UVA's netbadge
  - Actually an Apache module named Shibboleth
  - When you log in via Netbadge, your userid is stored as a `REMOTE_USER` session cookie
- On the course server, see /target/ and /target.php

## Sandboxing Javascript
[![](https://upload.wikimedia.org/wikipedia/commons/thumb/7/74/Sandpit.jpg/1024px-Sandpit.jpg)](https://commons.wikimedia.org/wiki/File:Sandpit.jpg)
- Javascript in a browser needs to have limited capabilities:
  - No file I/O, OS access, etc.
  - Cannot access other pages
    - But maybe from the same domain
- Enforced restrictions:
  - Runs in a sandbox
    - Has many features and capabilities disabled
  - Same Origin Policy is enforced

## Same Origin Policy
- Web browsers only allow one script to access data from another script if the scripts:
  - Are on the same domain
  - Use the same protocol
  - Use the same port
- This prevents a malicious script from accessing the data from another script

## Document Object Model (DOM)
![](http://www.cs.virginia.edu/~asb2t/duimg/n21/image20.png)
When an HTML page is parsed, the DOM tree is formed; Javascript interacts with the DOM

## Ajax
- Ajax = Asynchronous Javascript and XML
- It's how dynamic page content is loaded
- Example from [here](https://www.w3schools.com/xml/ajax_examples.asp):
```
function loadDoc() {
  var xhttp = new XMLHttpRequest();
  xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
      document.getElementById("demo").innerHTML =
      this.responseText;
    }
  };
  xhttp.open("GET", "ajax_info.txt", true);
  xhttp.send();
}
```
- Note the *callback function*

## Ajax
- All Ajax is based on one function:
  - `XMLHttpRequest()`
  - It allows for dynamic loading of content
- Now being replaced by the Fetch API
  - More powerful; a successor to Ajax

## Ajax and Browser policies
- Same Origin Policy
  - If server (domain) A served the web page, and the Ajax request comes from server (domain) B, the callback function will not receive the data
- Cross-origin resource sharing (CORS)
  - A web page can choose to allow opt to allow a different domain to access its data
  - In the HTTP header:
```
Access-Content-Allow-Origin: https://www.example.com
```
- These can be attacked via DNS rebinding attacks

## Websocket
[![](https://upload.wikimedia.org/wikipedia/commons/thumb/e/e5/Power_socket.jpg/575px-Power_socket.jpg)](https://commons.wikimedia.org/wiki/File:Power_socket.jpg)
- HTTP is half-duplex
  - The client requests, the server responds
  - Ajax does the same, just in the background
- Websocket allows a full-duplex connection
  - You can 'subscribe' to a data stream
    - This data will come through even if you are making other requests
- Websocket is not bound by the same origin policy

## Case study: [Cable Haunt](https://en.wikipedia.org/wiki/Cable_Haunt) (2020)
![](https://cablehaunt.com/assets/img/cable_haunt_gradient.png)
- Two vulnerabilities used together to attack cable modems
- [CVE-2019-19495](https://www.cve.org/CVERecord?id=CVE-2019-19495): Websocket was used to allow access to a spectrum analyzer API
  - But not bound by SOP
  - A malicious site could inject data via DNS rebinding
- [CVE-2019-19494](https://www.cve.org/CVERecord?id=CVE-2019-19494): buffer overflow in the cable modems
  - Can be used to gain a root shell on the cable modem
- 200 million vulnerable modems in Europe alone
- More information: [cablehaunt.com](https://cablehaunt.com/)

## XSS Vulnerable Scripts
- Let's envision a very simple web script
  - It asks you for your name in a web form text field in a web form
  - It takes that name, and displays a page that just says "hello, name!"
- While this is an (intentionally) very simple situation to show how XSS works, much more complicated ones exist
  - Ebay, where you enter your search string
  - Financial institutions, where you also enter a search string

## A very basic web page
```
<!doctype html>
<html>
  <head>
    <title>Basic page</title>
  </head>
  <body>
    <p>Hello world!</p>
  </body>
</html>
```

## The 'basic' web page, updated
```
<!doctype html>
<html>
  <head>
    <title>Basic web page</title>
<script>
var balance=1;
</script>
  </head>
  <body>
    <p>Hello Aaron!</p> 
    <p>Your account balance is 

<script>
document.write(balance);
</script>
    </p>
  </body>
</html>
```
Output: Hello, Aaron!  Your account balance is 1

## Using long URLs
- Perhaps the previous page can be obtained via:
```
http://www.nowhere.abc/printinfo.php?name=Aaron
```
- (not a real site, of course - notice the TLD is wrong)

## Exploiting the XSS vulnerability
- Instead of our name of 'Aaron', we will input the following as our name:
```
<script>\nbalance=1000000;\n</script>Aaron
```
- Note the necessary returns in the text (`\n`), which can also be represented as '%0a'
- Some browsers will work with the "\n" part removed entirely

## The HTML page afterward
```
<!doctype html>
<html>
  <head>
    <title>Basic web page</title>
<script>
var balance=1;
</script>
  </head>
  <body>
    <p>Hello <script>
balance=1000000;
</script>Aaron!</p>
    <p>Your account balance is 
<script>
document.write(balance);
</script>
    </p>
  </body>
</html>
```
Output: Hello Aaron! Your account balance is 1000000

## More complicated XSS attacks
- If a decision is based upon said balance, then the decision point can be changed
  - Not likely that such a decision will be decided client-side
- Perhaps you can inject code to view cookies or session variables
  - But these are easily discernible through the browser anyway
- So we need a reason do perform such an exploit...

## Long URLs
- Assume the page we developed can be obtained via:
  - http://www.nowhere.abc/printinfo.php?name=Aaron 
- Then why can't we do the following?
  - `http://www.nowhere.abc/printinfo.php?name=<script>\nbalance=1000000;\n</script>Aaron`
- That has some non-standard characters (spaces, quotes, returns), but we can fix those

## An XSS attack in a long URL
- We replace the punctuation with their web encodings:
  - \n with %0a
  - space with %20
  - ! with %21
  - \- with %2d
  - / with %2f
  - etc.
- Some are definitely necessary, others are just in case they are necessary

## An XSS attack in a long URL
- Our new (and rather long) URL:
  - http://www.nowhere.abc/printinfo.php?name=%3cscript%3e%0abalance%3d1000000%3b%0a%3c%2fscript%3eAaron   
- This contains an XSS attack in a URL!

## How to create an XSS exploit
- Download the HTML page, and save it locally
- Enter the script manually, and make sure it works
- *Then*, encode the script using URL-encoded text
  - There are online utilities to do this, such as the one at https://meyerweb.com/eric/tools/dencoder/
- Pass that to the web page
- Note that trying to edit the Javascript code through the URL-encoded text won't work!

## XSS exploit payloads
- An XSS exploit can be a URL link that somebody clicks on (perhaps via e-mail) that goes to bankofamerica.com, and...
  - Reads the account number and/or balance into Javascript variable(s)
  - Sends that data to a remote server
    - This can be done via XMLHttpRequest(), which is the function used for Web 2.0 functionality
- Alternately, it can be used to steal cookies, which can allow an attacker to impersonate a victim

## An XSS attack scenario
- Alice often visits Bob's website, where sensitive information is stored.
- Mallory observes that Bob's website contains a reflected XSS vulnerability.
- Mallory crafts an exploit URL, sends to Alice, and entices her to click on it
  - This URL is for Bob's website, but contains Mallory's malicious code, which the website will reflect (execute).
  - Alice visits the URL provided by Mallory while logged into Bob's website.

## An XSS attack scenario
- The malicious script embedded in the URL executes in Alice's browser, as if it came directly from Bob's server
  - This is the actual XSS vulnerability.
  - The script can be used to send Alice's session cookie to Mallory.
- Mallory can then use the session cookie to steal sensitive information available to Alice (authentication credentials, billing info, etc.) without Alice's knowledge.
- [Reference](https://en.wikipedia.org/wiki/Cross-site_scripting#Non-persistent)

## Defenses
- Treat data as data, and escape it!
  - Use web frameworks or modern PLs that do this for you
- There are many minute details to get right; see [here](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet) for details

<h2>Clickjacking Overview</h2>
<img src='http://www.cs.virginia.edu/~asb2t/duimg/n25/image4.png' style="float:left;width:300px">
<img src='http://www.cs.virginia.edu/~asb2t/duimg/n25/image6.png' style="float:right;width:300px">
<br clear='all'>

- Basic idea is to overlay a valid page with an invisible, malicious page
- The user sees the real page, and thinks s/he is interacting with it
- In reality, the invisible malicious page is being interacted with

## target.php
```html
<!DOCTYPE html>
<html><head>
  <title>Target desitnation page</title>
</head>
<body>
  <h2>Target destination page</h2>

<p>The GET variables are:</p>
  <ul>
<?php 
  $keys = array_keys($_GET); 
  asort($keys); 
  foreach ($keys as $k) 
    echo "<li><b>$k:</b> " . $_GET[$k] . "</li>"; 
?>
    </ul>

<p>The POST variables are:</p>
  <ul>
<?php $keys = array_keys($_POST); asort($keys); foreach ($keys as $k) echo "<li><b>$k:</b> " . $_POST[$k] . "</li>"; ?>
    </ul>

<p>The SERVER variables are:</p>
  <ul>
<?php $keys = array_keys($_SERVER); asort($keys); foreach ($keys as $k) echo "<li><b>$k:</b> " . $_SERVER[$k] . "</li>"; ?>
    </ul>

</body></html>
```

## Note
- The pages in this column will only work properly when viewed through a https:// link

## iframes
- Includes another web page inside a framed element
- Used for:
  - Embedding videos
  - Tweets on ~~Twitter~~ X
  - Etc.
- On the next slide:
```html
<iframe id="A" style="width:100%;height:400px" 
        src="//www.xkcd.com"></iframe>
```

## xkcd in an iframe
<iframe id="A" style="width:100%;height:400px;left:20px" src="//www.xkcd.com"></iframe>

- Code:
```html
<iframe id="A" style="width:100%;height:400px" 
        src="//www.xkcd.com"></iframe>
```

</div>

## Stacking iframes
We can stack one iframe on top of another:
```html
<style>
  #A { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #B { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:200px; top:200px; }
</style>
<iframe id="A" src="//www.xkcd.com"></iframe>
<iframe id="B" src="//nasa.gov"></iframe>
```

## Stacking iframes
<div>
<style>
  #A { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #B { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:200px; top:200px; }
</style>
<iframe id="A" src="//www.xkcd.com"></iframe>
<iframe id="B" src="//nasa.gov"></iframe>
</div>

## Stacking iframes w/opacity 0.7
<div>
<style>
  #C { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #D { width:100%; height:600px; 
       max-height:unset; max-width:unset;
       position:absolute; left:200px; top:200px; opacity:0.7 }
</style>
<iframe id="C" src="//www.xkcd.com"></iframe>
<iframe id="D" src="//nasa.gov"></iframe>
</div>

## HTML in an iframe
- If we want to put the following in an iframe
```html
<iframe><html><body><p>hello world</p></body></html></iframe>
```
- We have to encode it as such:
  - Replacing `<` with %3c, and `>` with %3e
```html
data:text/html;charset=utf-8,%3chtml%3e%3cbody%3e%3cp%3ehello world%3c/p%3e%3c/body%3e%3c/html%3e
```
- And then set as the src attribute:
```html
<iframe src="..."></iframe>
```
- Result:

## Clickjacking goal
- We want them to click on some specific area of the *actual* page
- Reasons:
  - Likejacking: they are clicking on the 'like' button of a social media page (that they are already logged into)
  - Form clickjacking: they are clicking on the 'submit' button of a form with pre-filled out data
  - Lots more

## Overlay page
- Our HTML content:
```html
<form action='//www.cs.virginia.edu/~asb2t/target.php?get_param=foo' 
      method='POST'>
  <input type='hidden' id='post_param' name='postparam' value='bar'>
  <input type='submit' value='click me! click me!'>
</form>
```
- Result:
<form action='//www.cs.virginia.edu/~asb2t/target.php?get_param=foo' method='POST' style="background-color:dimgrey;width:200px;border-radius:10px">    
  <input type='hidden' id='post_param' name='postparam' value='bar'>
  <input type='submit' value='click me! click me!'>
</form>

## Clickjacking page
<div>
<style>
  #E { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #F { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:220px; top:190px; opacity:0.9 }
</style>
<iframe id="E" src="//www.xkcd.com"></iframe>
<iframe id="F" style="background-color:white" src="data:text/html;charset=utf-8,%3chtml%3e%3cbody%3e%3cform action='https://www.cs.virginia.edu/~asb2t/target.php?get_param=foo' method='POST'%3e%3cinput type='hidden' id='post_param' name='postparam' value='bar'%3e%3cinput type='submit' value='click me! click me!'%3e%3c/form%3e%3c/body%3e%3c/html%3e"></iframe>
</div>
<div style="margin-top:450px">

- Success!

</div>

## Clickjacking page, more opacity
<div>
<style>
  #I { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #J { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:220px; top:190px; opacity:0.1 }
</style>
<iframe id="I" src="//www.xkcd.com"></iframe>
<iframe id="J" style="background-color:white" src="data:text/html;charset=utf-8,%3chtml%3e%3cbody%3e%3cform action='https://www.cs.virginia.edu/~asb2t/target.php?get_param=foo' method='POST'%3e%3cinput type='hidden' id='post_param' name='postparam' value='bar'%3e%3cinput type='submit' value='click me! click me!'%3e%3c/form%3e%3c/body%3e%3c/html%3e"></iframe>
</div>
<div style="margin-top:450px">

- This is 0.1 opacity (0.0 is invisible)
- Click on 'Feed Email'
- With full opacity, the result of the click is not visible either

</div>

<h2 class="r-fit-text">Clickjacking attempt, link version</h2>
<div>
<style>
  #G { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:100px; top:100px; }
  #H { width:100%; height:300px; 
       max-height:unset; max-width:unset;
       position:absolute; left:200px; top:200px; opacity:0.9 }
</style>
<iframe id="G" src="//www.xkcd.com"></iframe>
<iframe id="H" style="background-color:white" src="data:text/html;charset=utf-8,%3chtml%3e%3cbody%3e%3ca href='https://www.cs.virginia.edu/~asb2t/target.php?get_param=foo'%3eclick me! click me!%3c/a%3e%3c/body%3e%3c/html%3e"></iframe>
</div>
<div style="margin-top:450px">

- We can replace the button with a simple link
  - This only allows GET parameters, though

</div>

## If multiple clicks are needed...
- Have them play a "game" (like a CAPTCHA):
![](http://www.cs.virginia.edu/~asb2t/duimg/n25/image13.png)
- Each one they click on is one of the sequence of clicks

## Stealing login credentials
- Overlay a real page with your form:

## www.virginia.edu in an iframe

- Why didn't it work?
  - See the error in the developer console (Shift-Ctrl-C or Shift-Command-C)

## Defense 1: sameorigin

![](images/websecurity/error-sameorigin.webp)
- Two options
  - The difference is whether *that site* can iframe itself
- Now obsoleted by the `frame-ancestors` directive
```
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
```
```
Content-Security-Policy: frame-ancestors <source>;
Content-Security-Policy: frame-ancestors <space separated list of sources>;
```

## Defense 2: CSRF
- Cross-Site Request Forgery (CSRF) defenses
  - Only prevents form posting, not GET links
- Idea is to have a *token*
  - A random or hashed value that the web page can check on the next page load / form posting
- With TLS enabled, this token value in the form is encrypted, even if it is in the URL

## CSRF vulnerable example
- An example GET link: https://example.com/post.php?title=abcd&content=Lorem.ipsum
- An example POST submission form:
```html
 <form action="https://example.com/post.php" method="post">
  <input type="hidden" name="title" value="abcd">
  <input type="hidden" name="content" 
         value="Lorem.ipsum">
  <input type="submit" value="Submit">
</form> 
```
- This allows a posting *across* sites
- This form will only show a submit button, which can be disguised via CSS to look like *anything*

## HTML form with a CSRF token

With an included CSRF token:
```html
<form action="/form.php">
  First name: <input type="text" name="firstname">
  Last name: <input type="text" name="lastname"><br>
  <input type="hidden" name="csrf_token" 
         value="5AEF1xArSLLcoQQJrNkuaRs9tsSb8C8aFm">
  <input type="submit" value="Submit">
</form> 
```
- The result looks the same to the user:

<form action="/form.php" style="background-color:dimgray;border-radius:10px">
  First name: <input type="text" name="firstname"> 
  Last name: <input type="text" name="lastname"><br>
  <input type="hidden" name="csrf_token" 
         value="5AEF1xArSLLcoQQJrNkuaRs9tsSb8C8aFm">
  <input type="submit" value="Submit">
</form>

- Get version:
  - [https://example.com/form.php?firstname=Jane&lastname=Doe&csrf_token=...](https://example.com/form.php?firstname=Jane&lastname=Doe&csrf_token=...)

## CSRF Requirements
- The server needs to keep track of *which* token it sent and to *who*
  - The *who* is likely an (authenticated) user at a given IP address
- Token management
  - Random values can be stored in a server-side database
  - Or maybe based on cookie (which may be tied to an IP address)
  - Or maybe hashed from known values (IP, userid, etc.)
- That is included in the form, and linked to the user
- Modern web frameworks do this for you
  - The `csrf_token` from the previous slide was based on what Django provides

## Fuzzing
> automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program <br> \- Wikipedia

## Fuzzing uses
- For the attacker
  - Try different inputs to see which ones trigger a vulnerability
    - Often a buffer overflow, but can be a crash, unexpected results, etc.
- For the defender
  - To test your product (browser, server, protocol, program, etc.)

## Web fuzzing
- Given a list of commonly found URL endings
- Check a given website for each of them
- Word lists: see the [SecLists github repo](https://github.com/danielmiessler/SecLists/), specifically the [Fuzzing/ sub-directory](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing)
  - Also see [common.txt](https://aaronbloomfield.github.io/ics/hws/fuzzing/common.txt)
- Examples: [ffuf](https://github.com/ffuf/ffuf) and [wfuzz](https://wfuzz.readthedocs.io/en/latest/)

## Web fuzzing purpose
- See what files are available
  - And what can be further studied
- Find security holes
  - .ssh/id_rsa, for example
- Expose bugs
- Browser testing
  - MS Edge had 670 machine-years of fuzzing performed on it
  - Totaling 400 billion DOM manipulations and 1 billion HTML files [source](https://en.wikipedia.org/wiki/Fuzzing#Browser_security)

## American Fuzzy Lop
[![](https://upload.wikimedia.org/wikipedia/commons/a/a4/Conejillo_de_indias.jpg)](https://commons.wikimedia.org/wiki/File:Conejillo_de_indias.jpg)
- A path generating algorithm
- Given some sample inputs...
  - It will try mutating the values
  - Keeping track of which ones make progress
- It runs until the user presses Ctrl-C

## Python AFL Usage
- Install AFL via `git clone https://github.com/google/AFL`
- `pip3 install python-afl`
```python
import sys, afl, os

def testFunctionThatCouldCrash(x,y):
    # define function here that could crash
    pass

afl.init()
# read in x,y from input
testFunction(a,b,c)
os._exit(0)

```

## AFL Screenshot
![](images/websecurity/afl-screenshot.webp)

## Symbolic Execution
```
int f() {
  ...
  y = read();
  z = y * 2;
  if (z == 12) {
    fail();
  } else {
    printf("OK");
  }
}
```
- A form of static program execution
- Given the above code...
  - `y` (and thus `z`) can have any value
  - Thus, it will examine each block of the if-then in turn
- Via this branching, it will try to examine *all* paths through the program
- Good for *some* types of analysis
- There is also *dynamic* symbolic execution

## Binary program fuzzing
[![](https://angr.io/img/angry_face.png)](https://angr.io/)
- [Angr](https://angr.io/) is a binary fuzzing program
- Functionalities:
  - Symbolic execution
  - Static and dynamic analysis
  - Decompilation (but likely not as good as [Ghidra](https://ghidra-sre.org/) from the NSA)
- A great way to test for buffer overflow vulnerabilities
- Can also be run from Python

## Network protocol fuzzing
[![](https://www.kali.org/tools/spike/images/spike-logo.svg)](https://www.kali.org/tools/spike/)
- Consider [Spike](https://www.kali.org/tools/spike/), installed on Kali Linux
- Given a protocol description script
  - Describing how the data in the protocol is laid out
- It will send lots of somewhat random packets to test for vulnerabilities, such as buffer overflows