#!/usr/bin/perl
# bf2.pl
# 01.19.2009
# Browser Fuzzer 2
#
# Krakow Labs Development [krakowlabs.com] -> bf2
# "Browser Fuzzer 2 -- The bugs cannot hide anymore"
# rush@KL (Jeremy Brown) [rush[at]krakowlabs[dot]com]
#
# Associated Files & Information:
# http://www.krakowlabs.com/dev/fuz/bf2/bf2.pl.txt
# http://www.krakowlabs.com/dev/fuz/bf2/bf2_doc.txt
# http://www.krakowlabs.com/dev/fuz/bf2/bf2.tar.gz
# http://www.krakowlabs.com/dev/fuz/bf2/bf2.jpeg
# bf2.pl
use Getopt::Std;
# FUZZ DATA BEGIN HERE [_Jeremy Brown_ 3rd Generation Fuzzing Oracle [unlimited style, web] _Jeremy Brown_] 116
@overflows = ('A' x 2200, 'A' x 4200, 'A' x 8500, 'A' x 12000, 'A' x 22000, 'A' x 52000, 'A' x 120000, 'A' x 500500,
'A' x 1200000, 'A' x 5005000, 'A' x 12000000, 'A' x 20000000, '//AAAA' x 5000, '\\\AAAA' x 5000, '\0x99' x 12000,
'http://' . 'A' x 4200, 'http://' . 'A' x 12000, 'http://' . 'A' x 500500, 'http://' . 'A' x 5005000, 'http://' . 'A' x 20000000,
'www.' . 'A' x 4200 . '.com', 'www.' . 'A' x 12000 . '.com', 'www.' . 'A' x 500500 . '.com', 'www.' . 'A' x 5005000 . '.com', 'www.' . 'A' x 20000000 . '.com',
'A/' x 2100, 'A/' x 6000, 'A/' x 250250, 'A/' x 2502500, 'A/' x 10000000); # 30
@fmtstring = ('%n%n%n%n%n', '%p%p%p%p%p', '%s%s%s%s%s', '%d%d%d%d%d', '%x%x%x%x%x',
'%s%p%x%d', '%.1024d', '%.1025d', '%.2048d', '%.2049d', '%.4096d', '%.4097d',
'%99999999999s', '%08x', '%%20n', '%%20p', '%%20s', '%%20d', '%%20x',
'%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%', '\0xCD' x 50, '\0xCB' x 50); # 22
@numbers = ('0', '-0', '1', '-1', '32767', '-32768', '2147483647', '-2147483647', '2147483648', '-2147483648',
'4294967294', '4294967295', '4294967296', '357913942', '-357913942', '536870912', '-536870912', '5e-324', '1.79769313486231E+308', '3.39519326559384E-313',
'99999999999', '-99999999999', '0x100', '0x1000', '0x3fffffff', '0x7ffffffe', '0x7fffffff', '0x80000000', '0xffff', '0xfffffffe',
'0xfffffff', '0xffffffff', '0x10000', '0x100000', '0x99999999', '65535', '65536', '65537', '16777215', '16777216',
'16777217', '-268435455'); # 42
@miscbugs = ('test|touch /tmp/FU_ZZ_ED|test', 'test`touch /tmp/FU_ZZ_ED`test', 'test\'touch /tmp/FU_ZZ_ED\'test', 'test;touch /tmp/FU_ZZ_ED;test', 'test&&touch /tmp/FU_ZZ_ED&&test',
'test|C:/WINDOWS/system32/calc.exe|test', 'test`C:/WINDOWS/system32/calc.exe`test', 'test\'C:/WINDOWS/system32/calc.exe\'test', 'test;C:/WINDOWS/system32/calc.exe;test', 'C:/WINDOWS/system32/calc.exe',
'|/bin/sh|', '`/bin/sh`', '../..\\' x 500, '%0xa', '%u000', '`~@#$', '%^&*()', '-=_+', '[]\{}', '|;\':"',
',./<>', '?' x 12000); # 22
# FUZZ DATA END HERE [_Jeremy Brown_ 3rd Generation Fuzzing Oracle [unlimited style, web] _Jeremy Brown_] 116
# DOM BEGIN
@domwindow = ('outerHeight', 'outerWidth', 'status', 'moveBy', 'moveTo', 'resizeBy', 'resizeTo', 'scrollBy', 'scrollTo', 'setInterval', 'setTimeout'); # do
(first 3) & others -- window.resizeX/scrollX has 2 params & setX has 2
@domdocument = ('cookie', 'getElementById', 'getElementsByName', 'getElementsByTagName', 'open', 'write', 'writeIn'); # open can have 2 params
@domhistory = ('go');
@domlocation = ('hash', 'host', 'hostname', 'href', 'pathname', 'port', 'protocol', 'search', 'assign', 'replace');
# DOM END
# HTML BEGIN
@htmlbody = ('alink', 'background', 'bgcolor', 'link', 'text', 'vlink', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlp = ('align', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlhr = ('align', 'noshade', 'size', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlfont = ('color', 'face', 'size', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlbdo = ('dir', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlpre = ('width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmla = ('charset', 'coords', 'href', 'hreflang', 'name', 'rel', 'rev', 'shape', 'target', 'type', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmllink = ('charset', 'href', 'hrefland', 'media', 'rel', 'rev', 'target', 'type', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlframe = ('frameborder', 'longdesc', 'marginheight', 'marginwidth', 'name', 'noresize', 'scrolling', 'src', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlframeset = ('cols', 'rows', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmliframe = ('align', 'frameborder', 'height', 'longdesc', 'marginheight', 'marginwidth', 'name', 'scrolling', 'src', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlform = ('action', 'accept', 'accept-charset', 'enctype', 'method', 'name', 'target', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlinput = ('accept', 'align', 'alt', 'checked', 'disabled', 'maxlength', 'name', 'readonly', 'size', 'src', 'type', 'value', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltextarea = ('cols', 'rows', 'disabled', 'name', 'readonly', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlbutton = ('disabled', 'name', 'type', 'value', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlselect = ('disabled', 'multiple', 'name', 'size', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmloptgroup = ('label', 'disabled', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmloption = ('disabled', 'label', 'selected', 'value', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmllabel = ('for', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmllegend = ('align', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlul = ('compact', 'type', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlol = ('compact', 'start', 'type', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlli = ('type', 'value', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmldir = ('compact', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlmenu = ('compact', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlimg = ('alt', 'src', 'align', 'border', 'height', 'hspace', 'longdesc', 'usemap', 'vspace', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlmap = ('id', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlarea = ('alt', 'coords', 'href', 'nohref', 'shape', 'target', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltable = ('align', 'bgcolor', 'border', 'cellpadding', 'cellspacing', 'frame', 'rules', 'summary', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlcaption = ('align', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlth = ('abbr', 'align', 'axis', 'bgcolor', 'char', 'charoff', 'colspan', 'headers', 'height', 'nowrap', 'rowspan', 'scope', 'valign', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltr = ('align', 'bgcolor', 'char', 'charoff', 'valign', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltd = ('abbr', 'align', 'axis', 'bgcolor', 'char', 'charoff', 'colspan', 'headers', 'height', 'nowrap', 'rowspan', 'scope', 'valign', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlthead = ('align', 'char', 'charoff', 'valign', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltbody = ('align', 'char', 'charoff', 'valign', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmltfoot = ('align', 'char', 'charoff', 'valign', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlcol = ('align', 'char', 'charoff', 'span', 'valign', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlcolgroup = ('align', 'char', 'charoff', 'span', 'valign', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlstyle = ('type', 'media', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmldiv = ('align', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlhead = ('profile', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlmeta = ('content', 'http-equiv', 'name', 'scheme', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlbase = ('target', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlbasefont = ('color', 'face', 'size', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlscript = ('type', 'charset', 'defer', 'language', 'src', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlapplet = ('height', 'width', 'align', 'alt', 'archive', 'code', 'codebase', 'hspace', 'name', 'object', 'title', 'vspace', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlobject = ('align', 'archive', 'border', 'classid', 'codebase', 'codetype', 'data', 'declare', 'height', 'hspace', 'name', 'standby', 'type', 'usemap', 'vspace', 'width', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
@htmlparam = ('name', 'type', 'value', 'valuetype', 'class', 'id', 'style', 'title', 'dir', 'lang', 'accesskey', 'tabindex');
# HTML END
# JavaScript BEGIN
@jstlfuncs = ('decodeURI', 'decodeURIComponent', 'encodeURI', 'encodeURIComponent', 'escape', 'unescape', 'eval', 'isFinite', 'inNaN', 'Number', 'parseFloat', 'parseInt', 'String');
@jsstringmtds = ('strng.anchor', 'strng.charAt', 'strng.charCodeAt', 'strng.concat', 'strng.fontcolor', 'strng.fontsize', 'strng.fromCharCode', 'strng.indexOf', 'strng.lastIndexOf', 'strng.link',
'strng.link', 'strng.match', 'strng.replace', 'strng.search', 'strng.slice', 'strng.split', 'strng.substr', 'strng.substring');
@jsdatemtds = ('Date.parse', 'dte.setDate', 'dte.setFullYear', 'dte.setHours', 'dte.setMilliseconds', 'dte.setMinutes', 'dte.setMonth', 'dte.Seconds', 'dte.setTime', 'dte.setUTCDate',
'dte.setUTCMonth', 'dte.setUTCFullYear', 'dte.setUTCHours', 'dte.setUTCMinutes', 'dte.setUTCSeconds', 'dte.setUTCMilliseconds', 'dte.setYear');
@jsmathmtds = ('Math.abs', 'Math.acos', 'Math.asin', 'Math.atan', 'Math.atan2', 'Math.ceil', 'Math.cos', 'Math.exp', 'Math.floor', 'Math.log', 'Math.max', 'Math.min',
'Math.pow', 'Math.round', 'Math.sin', 'Math.sqrt', 'Math.tan');
@jsnumbermtds = ('numbr.toExponential', 'numbr.toFixed', 'numbr.toPercision', 'numbr.toString');
# JavaScript END
$cssbegin = '' . "\n" . '';
$htmlbegin = '';
$htmlend = '';
$scriptbegin = '';
$jsvarstrng = 'var strng = "test";';
$jsvardte = 'var dte = new Date();';
$jsvarnumbr = 'var numbr = new Number(1000);';
$refresh1 = '';
getopts('o:p:', \%opts);
$output = $opts{'o'};
$phase = $opts{'p'};
if(!defined($output) || !defined($phase))
{
print "\n Krakow Labs Development [krakowlabs.com] -> bf2";
print "\n \"Browser Fuzzer 2 -- The bugs cannot hide anymore\"";
print "\n rush\@KL (Jeremy Brown) [rush[at]krakowlabs[dot]com]\n";
print "\n Usage: $0 -o