skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-fuzz-testing-in-cicd-with-aflplusplus

Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines to detect memory corruption vulnerabilities.

954|172|Updated Mar 13, 2026
Search Tags:#vulnerability discovery#devsecops#afl++#fuzz testing#c/c++#ci/CD#coverage-guided fuzzing
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-fuzz-testing-in-cicd-with-aflplusplus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-fuzz-testing-in-cicd-with-aflplusplus
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/devsecops/implementing-fuzz-testing-in-cicd-with-aflplusplus
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-fuzz-testing-in-cicd-with-aflplusplus

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Compiled applications that parse untrusted input often contain memory corruption and input-handling bugs that static analysis and unit tests miss. This Skill guides the integration of AFL++ coverage-guided fuzzing into CI/CD pipelines so crashes, hangs, and undefined behavior are discovered continuously before release.

Core Features & Use Cases

  • Harness and Instrumentation Setup: Build persistent-mode fuzzing harnesses compiled with afl-clang-fast and AddressSanitizer for high-speed, high-sensitivity fuzzing.
  • CI/CD Pipeline Integration: Ready-to-adapt GitHub Actions workflows with corpus caching, crash detection that fails the build, and nightly long-run configurations.
  • Corpus and Crash Management: Seed corpus minimization with afl-cmin/afl-tmin, parallel fuzzing across cores, and crash triage with deduplication.
  • Use Case: A team maintaining a C++ file parser adds a fuzzing job to their pipeline; AFL++ mutates seed inputs for two hours nightly, and any new crash automatically fails the build with the crashing input attached for triage.

Quick Start

Set up an AFL++ fuzzing job in my GitHub Actions pipeline that builds my C parser harness with AddressSanitizer and fails the build if any crashes are found.

Frequently Asked Questions about implementing-fuzz-testing-in-cicd-with-aflplusplus

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate AFL++ fuzzing into a CI/CD pipeline?▼

Build your harness with afl-clang-fast and AFL_USE_ASAN=1, then run afl-fuzz in a CI job with a timeout and a cached seed corpus. Add a crash-check step that counts files under findings/*/crashes/ and exits with code 1 so the build fails when crashes exist.

How do I write a fuzzing harness for AFL++ persistent mode?▼

Use __AFL_FUZZ_INIT(), __AFL_INIT(), and the __AFL_LOOP macro to read test cases from __AFL_FUZZ_TESTCASE_BUF inside a loop. Reset target state each iteration and call your parser with the buffer and length, avoiding fork overhead for up to 100,000+ executions per second.

Does AFL++ work on Windows or binary-only targets?▼

AFL++ requires Linux-based CI runners and does not support Windows natively. For binary-only targets without source code, it offers QEMU mode, Frida mode, and Unicorn mode for firmware, though these run slower than compile-time instrumentation.

Why does AFL++ find no crashes or new paths during fuzzing?▼

Common causes are an empty or trivial seed corpus, missing dictionaries for structured formats, or a harness compiled with plain gcc instead of afl-clang-fast. Seed with diverse valid inputs, minimize with afl-cmin, and provide a dictionary or CmpLog binary for magic-byte comparisons.

How long should AFL++ fuzzing runs last in CI?▼

A 60-second run barely finishes calibration and gives false confidence. Give CI runs tens of minutes and nightly runs 4-24 hours, caching and feeding the corpus back between runs so coverage accumulates across executions.

Related Skills

Explore More Software Engineering Skills→
manuelbrandner85manuelbrandner85

fuzzing-dictionary

Generate domain-specific tokens and magic values for fuzzing parsers and protocol handlers.

Community
Intermediate
erenisiklarerenisiklar

address-sanitizer

Detect memory errors in C/C++ fuzzing with AddressSanitizer.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

coverage-analysis

Measure instrumented code coverage during fuzzing and generate reports.

Official
Intermediate
brucesongsbrucesongs
60

ai-fuzzing

Automate vulnerability discovery with AI-driven seed generation and coverage-guided fuzzing.

Community
Advanced