Grinder is a system to automate the fuzzing of web browsers and the management of a large number of crashes. Grinder Nodes provide an automated way to fuzz a browser, and generate useful crash information (such as call stacks with symbol information as well as logging information which can be used to generate reproducible test cases at a later stage). A Grinder Server provides a central location to collate crashes and, through a web interface, allows multiple users to login and manage all the crashes being generated by all of the Grinder Nodes.
System Requirements
A Grinder Node requires a 32/64 bit Windows system and Ruby 2.0 (Ruby 1.9 is also supported but you wont be able to fuzz 64bit targets).
A Grinder Server requires a web server with MySQL and PHP.
Features
Grinder Server features:
- Multi user web application. User can login and manage all crashes reported by the Grinder Nodes. Administrators can create more users and view the login history.
- Users can view the status of the Grinder system. The activity of all nodes in the system is shown including status information such as average testcases being run per minute, the total crashes a node has generated and the last time a node generated a crash.
- Users can view all of the crashes in the system and sort them by node, target, fuzzer, type, hash, time or count.
- Users can view crash statistics for the fuzzers, including total and unique crashes per fuzzer and the targets each fuzzer is generating crashes on.
- Users can hide all duplicate crashes so as to only show unique crashes in the system in order to easily manage new crashes as they occur.
- Users can assign crashes to one another as well as mark a particular crash as interesting, exploitable, uninteresting or unknown.
- Users can store written notes for a particular crash (viewable to all other users) to help manage them.
- Users can download individual crash log files to help debug and recreate testcases.
- Users can create custom filters to exclude uninteresting crashes from the list of crashes.
- Users can create custom e-mail alerts to alert them when a new crash comes into the system that matches a specific criteria.
- Users can change their password and e-mail address on the system as well as view their own login history.
Grinder Node features:
- A node can be brought up and begin fuzzing any supported browser via a single command.
- A node injects a logging DLL into the target browser process to help the fuzzers perform logging in order to recreate testcases at a later stage.
- A node records useful crash information such as call stack, stack dump, code dump and register info and also includes any available symbol information.
- A node can automatically encrypt all crash information with an RSA public key.
- A node can automatically report new crashes to a remote Grinder Server.
- A node can run largely unattended for a long period of time.
Grinder Screenshots
