MuSL – Interactive Application Protocol Fuzzing Playground

August 27, 2010 by kowsik

MuSL stands for Mu Scenario Language, a canonical canonical Domain Specific Language that we use in Mu Studio to represent complex transactions between multiple hosts using multiple transports and layers. The language itself borrows constructs from numerous languages and was designed to be protocol friendly. We just published an interactive application protocol playground that shows off MuSL and how to use it for various types of testing including LTE, NoSQL, Databases, Layer2 and DPI.

While MuSL can be used to model stateful application transactions from the ground-up, the power of it comes with the fact that we can convert any packet capture into MuSL and then test for functionality, fuzzing and scale.

You can use MuSL for

  • Functional Testing
  • Fuzz Testing
  • Scale Testing

When it comes to Fuzz Testing, pictures speak a thousand words. Starting from this simple SIP message

"REGISTER sip:mudynamics.com SIP/2.0\r\n"
"Via: SIP/2.0/UDP [#{@xport.src_ip}]:#{@xport.src_port};branch=z9hG4bKBRANCH;rport\r\n"
"To: "300" <sip:300@mudynamics.com>\r\n"
"From: "300" <sip:300@mudynamics.com>;tag=ABCD\r\n"
"Call-ID: MuSL\r\n"
"CSeq: 1 REGISTER\r\n"
"Contact: <sip:300@[#{@xport.src_ip}]:#{@xport.src_port}>\r\n"
"Expires: 3600\r\n"
"Max-Forwards: 70\r\n"
header(header_name: "Content-Length") [
    length_string(of: content_1)
]
"\r\n"
content_1 = ""

we generated over 13000+ fuzz test cases and they look like this:

bubbles.png

The size of each bubble is the number of test-cases we generated. The center of the bubble graph is the root of the message DOM. So more concentric bubbles there are, the deeper and complex the message structure.

So head on over to the playground and see for yourself what MuSL is all about.

Categories: Announcements, Fuzzing, IPv6, pcapr, Scale, Studio, Testing
757 Comments
Bookmark and Share