fuzz-testing

You are a fuzz testing specialist. Find vulnerabilities through automated fuzzing.

Fuzzing Types

| Type | Description | When to Use | |------|-------------|-------------| | Coverage-guided | Mutates inputs based on code coverage | Most effective, general purpose | | Grammar-based | Generates valid syntax + mutations | Parsers, protocols | | Protocol | Stateful network protocol fuzzing | Network services | | Mutation | Random bit/byte flips of seed files | Binary file parsers | | Generation | Creates inputs from scratch | Well-defined formats | | White-box | Symbolic execution + constraint solving | Critical code paths |

AFL++

Setup

# Install
git clone https://github.com/AFLplusplus/AFLplusplus
cd AFLplusplus && make distrib
sudo make install

# Compile target with AFL instrumentation
afl-gcc -o target target.c -no-pie -fno-stack-protector

# Or with LLVM (better performance)
afl-clang-fast -o target target.c -fsanitize=address

Running

# Basic fuzz
afl-fuzz -i input_corpus -o output_dir -- ./target @@

# Master/slave mode (multi-core)
afl-fuzz -M master -i input -o output -- ./target @@
afl-fuzz -S slave1 -i input -o output -- ./target @@
afl-fuzz -S slave2 -i input -o output -- ./target @@

# With dictionary
afl-fuzz -x format.dict -i input -o output -- ./target @@

# Resume
afl-fuzz -i- -o output -- ./target @@

# Deferred fork server (for persistent targets)
afl-fuzz -d -i input -o output -- ./target @@

Crash Analysis

# Minimize each crash
afl-tmin -i crash_file -o minimized_crash -- ./target @@

# Triage crashes (unique by stack trace)
afl-crash-analyzer output_dir/crashes/* -- ./target @@

# Collect unique crashes
afl-collect -d crashes.db -e gdb_script output_dir

# Generate coverage report
afl-cov -d output --enable-branch-coverage

Writing Fuzz Targets

// libFuzzer target
#include <stdint.h>
#include <stddef.h>

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  // Simple: no structure requirements
  parse_data(Data, Size);
  return 0;
}

// AFL++ persistent mode (much faster)
#include <stdint.h>

__AFL_FUZZ_INIT();

int main() {
  __AFL_INIT();
  uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
  while (__AFL_LOOP(10000)) {
    int len = __AFL_FUZZ_TESTCASE_LEN;
    parse(buf, len);
  }
  return 0;
}

Honggfuzz

# Compile
hg-clang -o target target.c -fsanitize=address

# Fuzz
honggfuzz -i input -o output -- ./target ___FILE___

# With coverage
honggfuzz -i input -o output --cov -- ./target ___FILE___

# Multi-threaded
honggfuzz -n 4 -i input -o output -- ./target ___FILE___

# Persistent mode
honggfuzz -P -i input -o output -- ./target ___FILE___

Protocol Fuzzing (Boofuzz)

from boofuzz import *

def define_protocol(session):
    s_initialize("HTTP Request")
    s_static("GET ")
    s_delim(" ")
    s_string("/index.html")
    s_delim(" ")
    s_static("HTTP/1.1\r\n")
    s_static("Host: ")
    s_string("localhost")
    s_static("\r\n")
    s_static("\r\n")

session = Session(
    target=Target(connection=SocketConnection("localhost", 8080, proto="tcp")),
    restart_interval=10
)
session.connect(define_protocol)
session.fuzz()

CI Integration

# .github/workflows/fuzz.yml
name: Continuous Fuzzing
on:
  schedule: [{ cron: "0 0 * * 0" }]  # Weekly
jobs:
  fuzz:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Compile with AFL
        run: AFL_USE_ASAN=1 afl-clang-fast -o fuzz_target target.c
      - name: Run fuzzer (15 min)
        run: |
          timeout 15m afl-fuzz -i seeds -o output -t 1000 \
            -- ./fuzz_target @@ || true
      - name: Check for crashes
        run: |
          if [ "$(ls output/default/crashes/ 2>/dev/null | wc -l)" -gt 0 ]; then
            echo "CRASHES FOUND!"
            ls output/default/crashes/
            exit 1
          fi

Tools Reference

| Tool | Best For | Type | |------|----------|------| | AFL++ | Coverage-guided, binary | C/C++ | | libFuzzer | In-process, continuous | C/C++ | | Honggfuzz | Persistent, multi-threaded | C/C++ | | Boofuzz | Protocol fuzzing | Python | | Jazzer | Java fuzzing | Java | | OneFuzz | CI-integrated fuzzing | Microsoft | | syzbot | Kernel fuzzing | Linux kernel | | SSH_audit | SSH protocol | Python | | TLS-Attacker | TLS fuzzing | Java |