← All cheat sheets

🌶 DOONA

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Doona is a fork of BED (Bruteforce Exploit Detector) with additional
protocol plugins and improvements. It fuzzes network services to
discover potential buffer overflows, format strings, and other
memory corruption vulnerabilities.

doona -m <module> -t <target>    # Fuzz target with module
doona -m <module> -t <target> -p <port>
                                 # Fuzz on custom port

doona -m <module>                # Select protocol module
doona -t <target>                # Target IP address
doona -p <port>                  # Target port (default per module)
doona -o <timeout>               # Timeout in seconds
doona -r <retries>               # Number of retries

doona -m FTP -t <target>         # Fuzz FTP service
doona -m HTTP -t <target>        # Fuzz HTTP service
doona -m IMAP -t <target>        # Fuzz IMAP service
doona -m IRC -t <target>         # Fuzz IRC service
doona -m LPD -t <target>         # Fuzz Line Printer Daemon
doona -m PJL -t <target>         # Fuzz Printer Job Language
doona -m POP -t <target>         # Fuzz POP3 service
doona -m PROXY -t <target>       # Fuzz HTTP proxy
doona -m RTSP -t <target>        # Fuzz RTSP service
doona -m SMTP -t <target>        # Fuzz SMTP service
doona -m SOCKS4 -t <target>      # Fuzz SOCKS4 proxy
doona -m SOCKS5 -t <target>      # Fuzz SOCKS5 proxy
doona -m TFTP -t <target>        # Fuzz TFTP service
doona -m WHOIS -t <target>       # Fuzz WHOIS service

# Fuzz FTP server
doona -m FTP -t 192.168.1.1

# Fuzz SMTP on custom port
doona -m SMTP -t 192.168.1.1 -p 2525

# Fuzz HTTP with timeout
doona -m HTTP -t 192.168.1.1 -o 5

# Fuzz RTSP streaming server
doona -m RTSP -t 192.168.1.1 -p 554

# Fuzz TFTP service
doona -m TFTP -t 192.168.1.1 -p 69

# Doona sends for each protocol:
# - Oversized strings (A * 1000, A * 5000, A * 10000)
# - Format string specifiers (%s%s%s, %n%n%n, %x%x%x)
# - Null bytes and special characters
# - Protocol-specific malformed commands
# - Boundary values (0, -1, MAX_INT)
# - Long repeated patterns with different chars

# 1. Identify target service and version
# 2. Select appropriate Doona module
# 3. Run Doona against target
# 4. Monitor target for crashes (attach debugger)
# 5. Record crashing test cases
# 6. Analyze crash with debugger
# 7. Determine exploitability

- Fork of BED with more modules (RTSP, TFTP, WHOIS, PROXY)
- Can crash services - use in controlled environments
- Perl-based tool
- Monitor target with a debugger during fuzzing
- Does not develop exploits, only identifies crashes
- Consider boofuzz or AFL for more advanced fuzzing
- Useful for quick vulnerability assessment