This is the command bfbtester that can be run in the OnWorks free hosting provider using one of our multiple free online workstations such as Ubuntu Online, Fedora Online, Windows online emulator or MAC OS online emulator
bfbtester - Brute Force Binary Tester
bfbtester [-htv] [-d level] [-r rejects] [-o out-file] [-x max-execs] -a|[-sme] files ...
BFBTester is great for doing quick, proactive, security checks of binary programs.
BFBTester will perform checks of single and multiple argument command line overflows as
well as environment variable overflows. BFBTester can also watch for tempfile creation
activity to alert the user of any programs using unsafe tempfile names. While BFBTester
can not test all overflows in software, it is useful for detecting initial mistakes that
can red flag dangerous software.
You must specify one or more of the following tests:
-s Single Argument Test.
-m Multiple Argument Test.
-e Environment Variable Test.
-a Selects all tests
-h Print help.
-t Enable tempfile monitoring.
-v Print version string.
Set debug level (default = 0, max = 2).
Comma separated list of binaries to skip.
Output to out-file rather than stdout.
Set maximum executables to run in parallel (default = 250).
file Specific binary or a directory of binaries to test.
You must specify at least one test to run and you must specify either a binary or a
Executable selection is now done in one of several ways:
If the executable filename is specified with a leading slash (an absolute path), no
selection is used and the supplied absolute filename is used.
If there is no leading slash in the filename the selection is made in one of two ways (in
1) Prepend file name with $PWD and test accesiblity
2) Search through $PATH and find first accessible executable The first one to succeed is
the executable choosen.
If the filename found is a directory, we walk the directory (one level deep) looking for
Symbolic links are followed.
You can specify binaries to skip (useful when loading a whole directory) by using the -r
The following is a crash report:
*** Crash </usr/bin/patch> ***
args: -D 
Signal: 11 ( Segmentation fault )
This means "/usr/bin/patch" crashed when fed with an "-D" and a word 5,120 characters
$ /usr/bin/patch -D AAA...5,120 characters...AAA
(Numbers in brackets mean replace with a word that many characters long)
BFBTester is very CPU intensive, and will open many files, so you probably don't want to
run it on a production machine during it's busiest period. Just a warning...
bfbtester -s /usr/bin
Run the single argument test on all binaries in folder /usr/bin.
bfbtester -ta patch traceroute
Run all tests against patch and traceroute and run the tempfile monitor.
bfbtester -a ./bfbtester
Tests bfbtester (provided it's in the same directory).
bfbtester -r kill /usr/bin/kill
Use bfbtester online using onworks.net services