Boofuzz requires Python ≥ 3.5. Recommended installation requires
pip. As a base requirement, the following packages
sudo apt-get install python3-pip python3-venv build-essential
sudo zypper install python3-devel gcc
sudo yum install python3-devel gcc
It is strongly recommended to set up boofuzz in a virtual environment (venv). First, create a directory that will hold our boofuzz install:
$ mkdir boofuzz && cd boofuzz $ python3 -m venv env
This creates a new virtual environment env in the current folder. Note that the
Python version in a virtual environment is fixed and chosen at its creation.
Unlike global installs, within a virtual environment
python is aliased to
the Python version of the virtual environment.
Next, activate the virtual environment:
$ source env/bin/activate
Or, if you are on Windows:
Ensure you have the latest version of both
(env) $ pip install -U pip setuptools
Finally, install boofuzz:
(env) $ pip install boofuzz
To run and test your fuzzing scripts, make sure to always activate the virtual environment beforehand.
Like above, it is recommended to set up a virtual environment. Depending on your concrete setup, this is largely equivalent to the steps outlined above. Make sure to upgrade
Download the source code. You can either grab a zip from https://github.com/jtpereyda/boofuzz or directly clone it with git:
$ git clone https://github.com/jtpereyda/boofuzz.git
pipfrom within the boofuzz directory after activating the virtual environment:
$ pip install .
-eoption for developer mode, which allows changes to be seen automatically without reinstalling:
$ pip install -e .
To install developer tools (unit test dependencies, test runners, etc.) as well:
$ pip install -e .[dev]
Note that black needs Python ≥ 3.6.
If you’re behind a proxy:
$ set HTTPS_PROXY=http://your.proxy.com:port
If you’re planning on developing boofuzz itself, you can save a directory and create your virtual environment after you’ve cloned the source code (so
env/is within the main boofuzz directory).
The process monitor is a tool for detecting crashes and restarting an application on Windows or Linux. While boofuzz typically runs on a different machine than the target, the process monitor must run on the target machine itself.
The network monitor was Sulley’s primary tool for recording test data, and has been replaced with boofuzz’s logging mechanisms. However, some people still prefer the PCAP approach.
The network monitor requires Pcapy and Impacket, which will not be automatically installed with boofuzz. You can
manually install them with
pip install pcapy impacket.
If you run into errors, check out the Pcapy requirements on the project page.