Loading
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, cover
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a cursor -y
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.
| Type | Coverage | Speed | Tools |
|---|---|---|---|
| BlackBox | Poor | Fast | Peach, Boofuzz |
| GreyBox | Good | Fast | AFL++, Honggfuzz, libFuzzer, WinAFL |
| Snapshot | Good | Fastest | Nyx, wtf, Snapchange |
| WhiteBox | Best | Slow | KLEE, QSYM, SymSan |
| Ensemble | Best | Fast | AFL++ + Honggfuzz + libFuzzer |
GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).
Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report
copy_from_user — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks# AFL++ (preferred for GreyBox)
CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j
# libFuzzer + ASan/UBSan (C/C++)
cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..
# CmpLog build for hard compares
AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all
Windows (MSVC): Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)
libFuzzer (C++):
#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
parse_or_process(data, size);
return 0;
}
Honggfuzz HF_ITER (persistent mode — preferred for large targets):
#include "honggfuzz.h"
int main(int argc, char** argv) {
initialize_target(); // runs once
for (;;) {
size_t len; uint8_t *buf;
HF_ITER(&buf, &len);
FILE* s = fmemopen(buf, len, "r");
target_function(s);
fclose(s);
reset_target_state();
}
}
AFL++ persistent mode (__AFL_LOOP):
while (__AFL_LOOP(10000)) {
// re-read input and process
}
macOS IPC (Mach message fuzzing):
void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
pFunction = dlsym(lib_handle, "DesiredFunction");
afl-cmin -i raw_corpus -o seeds -- ./target @@afl-tmin -i crash -o crash.min -- ./target @@AFL++ parallel (primary + secondary with cmplog):
afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@
libFuzzer:
./target_libfuzzer corpus/ -max_total_time=3600 -workers=4
Binary-only (QEMU):
afl-fuzz -Q -i seeds -o findings -- target.exe @@
Snapshot (AFL++ Nyx):
NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@
Ensemble (AFL++ + Honggfuzz sharing corpus):
# Terminal 1
afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@
# Terminal 2
../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \
--linux_perf_ipt_block -t 10 -- ./target ___FILE___
If progress stalls:
-c 0 on AFL++ secondaries-x dict.txt or AFL_TOKEN_FILEAFL_MAP_SIZE=1048576, -L 0 for MOpt scheduler# 1. Minimize
afl-tmin -i crash -o crash.min -- ./target @@
# 2. Symbolize
ASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log
# 3. Hash + bucket
./cov-tool --bbids ./target crash.min > cov.hash
./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/
Sanitizer env quick reference:
ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1
UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1
TSAN_OPTIONS=halt_on_error=1:history_size=7
MSAN_OPTIONS=poison_in_dtor=1:track_origins=2
| Bug Class | Oracle |
|---|---|
| Memory safety | ASan, HWASan (AArch64, lower overhead) |
| Uninitialized reads | MSan |
| Concurrency | TSan |
| Undefined behavior | UBSan |
| Type safety | TypeSan |
| Heap hardening | Scudo Hardened Allocator |
| Logic bugs | Differential / idempotency oracles |
| Kernel memory | KASAN, KMSAN, KCSAN |
| Kernel UB | KUBSan (CONFIG_UBSAN_TRAP=y) |
| CFI | KCFI (-fsanitize=kcfi, Clang 18) |
| Binary-only | QASAN (QEMU+ASan), DynamoRIO |
Property oracle patterns:
f(x) == f(f(x)){
"target": "linux/arm64",
"http": ":56700",
"workdir": "/path/to/workdir",
"kernel_obj": "/path/to/kernel",
"image": "/path/to/rootfs.ext3",
"sshkey": "/path/to/id_rsa",
"procs": 8,
"enable_syscalls": ["openat$module_name", "ioctl$IOCTL_CMD", "mmap"],
"type": "qemu",
"vm": { "count": 4, "cpu": 2, "mem": 2048 }
}
enable_syscalls to deepen coverage on specific subsystemssyz-extract to pull constants for custom modulesCONFIG_KASAN=y, CONFIG_KCFI=y, CONFIG_DEBUG_INFO_BTF=ykcov filters and syz_cover_filter to direct coverageTUN/TAP + pseudo-syscalls (syz_emit_ethernet)./scripts/decode_stacktrace.sh vmlinux ... < dmesg.logsyzkaller repro:
syz-execprog -repeat=0 -procs=1 -cover=0 -debug target.repro
WTF snapshot harness skeleton (mpengine.dll / mini-filter):
g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
const uint64_t BCode = Backend->GetArg(0);
Backend->Stop(Crash_t(fmt::format("crash-{:#x}", BCode)));
});
FilterConnectionPort fuzzing:
HANDLE hPort;
FilterConnectCommunicationPort(L"\\PortName", 0, NULL, 0, NULL, &hPort);
FilterSendMessage(hPort, fuzzData, sizeof(fuzzData), NULL, 0, &bytesReturned);
IOCTL fuzzing pattern:
HANDLE hDev = CreateFile(L"\\\\.\\DeviceName", GENERIC_READ|GENERIC_WRITE, ...);
DeviceIoControl(hDev, ioctlCode, inputBuf, inputLen, outBuf, outLen, &ret, NULL);
DRIVER_VERIFIER_DETECTED_VIOLATION (0xc4), IRQL_NOT_LESS_OR_EQUAL (0xa).symfix; !analyze -v; k; !heap -p -a @raxCross-platform mpengine.dll on Linux (loadlibrary + HF_ITER + Intel PT):
// Bypass Lua VM to avoid stability issues
insert_function_redirect((void*)luaV_execute_address, my_lua_exec, HOOK_REPLACE_FUNCTION);
for (;;) {
HF_ITER(&buf, &len);
ScanDescriptor.UserPtr = fmemopen(buf, len, "r");
__rsignal(&KernelHandle, RSIG_SCAN_STREAMBUFFER, &ScanParams, sizeof ScanParams);
}
# Full Rust fuzzing pipeline
cargo test # 1. property tests
cargo +nightly miri test # 2. UB via interpreter
cargo +nightly careful test # 3. runtime bounds checks
cargo fuzz run fuzz_target_1 -- -max_total_time=3600 # 4. libFuzzer crashes
RUSTFLAGS="--cfg loom" cargo test --release # 5. concurrency (if needed)
cargo fuzz coverage fuzz_target_1 # 6. coverage report
Focus unsafe blocks on: Vec::from_raw_parts, unchecked indexing, transmute size mismatches, pointer arithmetic, FFI integer truncation.
go test -fuzz=Fuzz -run=^$ ./...cargo-fuzz or honggfuzz-rs__builtin_return_address(0) for PC tracking)wasmtime-fuzz, wafl for differential fuzzing across V8/Wasmer/Wasmtime- name: Build with afl-clang-fast
run: CC=afl-clang-fast make -j
- name: Fuzz (smoke, 15 min)
run: timeout 15m afl-fuzz -i seeds -o findings -- ./target @@ || true
- name: Upload crashes
if: always()
uses: actions/upload-artifact@v4
with:
path: findings/**/crashes/*
Use ClusterFuzzLite for persistent continuous fuzzing; cache corpora between runs.
Linux:
ulimit -c unlimited && sysctl -w kernel.core_pattern=core.%e.%p
gdb -q ./target core.* -ex 'bt' -ex 'info reg' -ex q
addr2line -e ./target 0xDEADBEEF
Windows:
# Enable local dumps
New-Item 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps' -Force
# PageHeap
gflags /p /enable target.exe /full
Kernel KASAN/KMSAN:
dmesg -T | egrep -i 'kasan|kmsan' -A 60
./scripts/decode_stacktrace.sh vmlinux /lib/modules/$(uname -r)/build < dmesg.log
Reproducibility: pin CPU governor, disable ASLR only where safe, fix RNG seeds, save input sequences in persistent mode, record binary hashes and sanitizer options with every crash.
| Tool | Use Case |
|---|---|
| AFL++ | General GreyBox, CmpLog, MOpt, Nyx |
| Honggfuzz | Intel PT, crash detection, HF_ITER |
| libFuzzer | In-process, source available |
| syzkaller | Linux/Windows kernel syscall fuzzing |
| wtf | Snapshot fuzzing, Windows targets |
| Nyx | AFL++ snapshot mode (Intel PT) |
| Snapchange | AWS snapshot fuzzing |
| LibAFL | Custom Rust fuzzing framework |
| AFLGo | Directed fuzzing to target BB/function |
| kAFL | Kernel + OS fuzzing |
| Jackalope | Binary coverage-guided (Windows/macOS) |
| cargo-fuzz | Rust libFuzzer integration |
| Atheris | Python fuzzing |
| Nautilus | Grammar-based fuzzing |
| AFLTriage | Automated crash triage |
| afl-cov | Coverage analysis for AFL++ |
| ClusterFuzz | Distributed fuzzing infrastructure |