skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

fuzzing-course

Teaches coverage-guided fuzzing methodology with AFL++, FuzzTest, and Honggfuzz for vulnerability discovery.

Updated Sep 17, 2026
Search Tags:#vulnerability discovery#exploit development#fuzzing#addresssanitizer#libfuzzer#afl++#crash triage
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill fuzzing-course-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fuzzing-course
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-fuzzing-course
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill fuzzing-course-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Learning to find memory corruption vulnerabilities requires structured, hands-on practice with real fuzzing tools, and most engineers lack a guided path from basic AFL++ runs to triaging crashes in production parsers. ## Core Features & Use Cases - Coverage-Guided Fuzzing Labs: Step-by-step AFL++ setup, instrumentation with sanitizers (ASAN/UBSAN), seed corpus generation, and parallel master/slave fuzzing campaigns. - Multiple Fuzzer Workflows: Covers AFL++ for whole programs, Google FuzzTest for in-process property-based fuzzing of C++ functions, and Honggfuzz, with guidance on when each fits. - Crash Triage and Real CVE Case Studies: Minimization with afl-tmin, clustering with casr-afl, and analysis of real bugs like CVE-2024-47606 (GStreamer) and CVE-2023-4863 (libWebP). - Use Case: A security engineer sets up a fuzzing campaign against an image parser, builds a minimized seed corpus, runs parallel AFL++ instances with sanitizers enabled, and triages the resulting crashes for exploitability. ## Quick Start Walk me through setting up AFL++ with AddressSanitizer to fuzz a C parser and triage any crashes it finds.

Frequently Asked Questions about fuzzing-course

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up AFL++ to fuzz a C program?▼

Install LLVM and build AFL++ from source, then compile the target with afl-clang-fast and run afl-fuzz with a seed input directory. The course provides full commands including core pattern configuration and sanitizer options like AFL_USE_ASAN.

What is the difference between AFL++ and Google FuzzTest?▼

AFL++ fuzzes whole programs or binaries externally, while FuzzTest runs in-process inside GoogleTest binaries using FUZZ_TEST macros. FuzzTest suits fuzzing individual C++ functions like parsers when you have source code and existing unit tests.

How do I triage and deduplicate fuzzer crashes?▼

Use afl-tmin to minimize a crashing input while preserving the crash, then cluster crashes with casr-afl from the CASR tools. AddressSanitizer reports and GDB with GEF help identify unique stack traces and root causes.

Why does my fuzzing campaign find no crashes?▼

Real targets often require hours or days of fuzzing, and hardened code may yield nothing quickly. Improve results with a minimized corpus of valid inputs, dictionaries, parallel master/slave instances, and sanitizers that turn subtle bugs into immediate crashes.

Does seed corpus quality affect fuzzing results?▼

Yes, valid structured seeds let the fuzzer reach deep parsing logic instead of failing early validation. Use afl-cmin to remove redundant files and afl-tmin to shrink inputs while preserving coverage.

Related Skills

Explore More Software Engineering Skills→
alicangnllalicangnll

Auto Exploit

Detect common software vulnerabilities and generate proof-of-concept exploits.

Community
Advanced
kaminocorpkaminocorp
1

exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

Official
Advanced
yhy0yhy0
74

vuln-patterns-auth-bypass

Analyze Python authentication flows for bypass vulnerabilities across CWE-285, CWE-287, and CWE-863.

Community
Advanced
monmacllcappmonmacllcapp

fuzzing-obstacles

Patch C/C++ or Rust code with conditional compilation to bypass fuzzing obstacles.

Official
Intermediate