fuzzing-dictionary

Create a text file with one quoted string per line, such as kw1="blah" or "\xF7\xF8" for binary bytes. Pass it to the fuzzer with ./fuzz -dict=./dictionary.dict corpus/ and tokens will be inserted during mutations.

Pass the dictionary file with the -x flag: afl-fuzz -x ./dictionary.dict -i in -o out -- ./target. AFL++ supports multiple -x flags, and afl-clang-lto can auto-generate dictionaries via the AFL_LLVM_DICT2FILE environment variable.

A corpus provides complete seed inputs that establish structure, while a dictionary provides individual tokens the fuzzer splices into mutations. They complement each other: corpus gives valid skeletons, dictionary supplies keywords to reach deeper logic.

go-fuzz has no built-in dictionary flag. Instead, convert dictionary entries into corpus seed files by writing each token as an individual file in the corpus directory before running go-fuzz.

Coverage stalls when dictionary tokens do not match the target's actual keywords, entries exceed -max_len, or the dictionary is too large. Analyze the target source for real keywords and prune to 50-200 relevant entries.

Keep dictionaries focused at roughly 50-200 entries. Oversized dictionaries slow the fuzzer and dilute useful tokens, while too few entries limit mutation diversity. Deduplicate with sort -u and document sections with comments.