Doona

Doona is a fork of BED, a program which detects potential buffer overflows, format string bugs, and other vulnerabilities in network daemons. It operates by sending malformed or oversized inputs to targeted services across supported protocols, monitoring for crashes or anomalous behavior that indicates exploitable conditions.

Use cases include vulnerability assessment of network services like HTTP, FTP, SMTP, and others listed in its modules. Security researchers and penetration testers can use it to identify weaknesses in daemons running on localhost or remote hosts, helping prioritize further exploitation or patching efforts.

The tool is lightweight, with an installed size of 128 KB, and requires only Perl as a dependency. It provides options for health checks, timeouts, resuming sessions, and module-specific configurations to fine-tune fuzzing campaigns.

Doona uses protocol-specific modules (e.g., HTTP, FTP, SMTP) to send fuzzing payloads such as buffer overflow patterns (e.g., XAXAX) to the target host and port. It progresses through test cases sequentially, with options to perform health checks after specified intervals, timeouts between tests, and resuming from a given index. Modules connect to standard or custom ports, sending crafted inputs to provoke crashes or errors indicative of vulnerabilities like buffer overflows or format string issues. Output includes progress indicators and completion status.