skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

offensive-fuzzing

Guides offensive fuzzing campaigns from target research through crash triage across multiple fuzzer frameworks.

Updated Jun 26, 2026
Search Tags:#sanitizers#vulnerability research#fuzzing#Harness#AFL++#crash triage#syzkaller
One-click install
npx skills add https://github.com/brukal001/brukal --skill offensive-fuzzing-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-fuzzing
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/fuzzing/offensive-fuzzing
Command: npx skills add https://github.com/brukal001/brukal --skill offensive-fuzzing-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers need a structured methodology to find memory-safety and logic bugs in parsers, kernels, drivers, and runtimes, but choosing fuzzers, writing harnesses, and triaging crashes correctly is error-prone without deep tooling knowledge. ## Core Features & Use Cases - Fuzzer Selection & Setup: Compares BlackBox, GreyBox, Snapshot, WhiteBox, and Ensemble fuzzing with concrete build commands for AFL++, libFuzzer, Honggfuzz, syzkaller, and wtf. - Harness & Corpus Engineering: Provides persistent-mode harness templates (HF_ITER, __AFL_LOOP), seed corpus minimization with afl-cmin/afl-tmin, and sanitizer oracle selection (ASan, MSan, TSan, KASAN, KCFI). - Specialized Targets: Covers Linux kernel fuzzing with syzkaller, Windows EDR/mpengine snapshot fuzzing, Rust pipelines (cargo-fuzz, Miri, loom), and binary-only targets via QEMU, Nyx, and LibAFL. - Use Case: A researcher auditing a file parser builds an AFL++ CmpLog target, runs a parallel campaign with a dictionary, then minimizes, symbolizes, and buckets the resulting crashes for reporting. ## Quick Start Help me set up an AFL++ fuzzing campaign with a persistent harness and seed corpus for my C++ file parser target.

Frequently Asked Questions about offensive-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up an AFL++ fuzzing campaign?▼

Build the target with afl-clang-fast, write a persistent harness using __AFL_LOOP, minimize a seed corpus with afl-cmin, then launch a primary instance with afl-fuzz -M and secondaries with -S and -c 0 for CmpLog. Add a dictionary with -x if progress stalls.

AFL++ vs libFuzzer vs Honggfuzz: which fuzzer should I use?▼

libFuzzer suits in-process fuzzing when source is available, AFL++ is the general GreyBox choice with CmpLog and MOpt, and Honggfuzz offers Intel PT feedback and the HF_ITER persistent mode for large targets. Ensemble runs combine all three sharing a corpus.

Can I fuzz closed-source binaries without source code?▼

Yes, use AFL++ QEMU mode (-Q) for binary-only coverage, QASAN for sanitizer support under QEMU, or snapshot fuzzers like Nyx, wtf, and Snapchange. Retrowrite and LibAFL also support binary rewriting and zero-instrumentation feedback.

How do I fuzz the Linux kernel with syzkaller?▼

Configure a JSON file with target arch, kernel_obj, image, and QEMU VM settings, then limit enable_syscalls to focus on specific subsystems. Enable CONFIG_KASAN, CONFIG_KCFI, and CONFIG_DEBUG_INFO_BTF, and decode crashes with scripts/decode_stacktrace.sh.

Why is my fuzzing campaign not finding new coverage?▼

Stalled campaigns usually need CmpLog secondaries (-c 0), a target-specific dictionary, or directed fuzzing with AFLGo toward specific basic blocks. Concolic tools like QSYM or Driller can solve hard branches, and snapshot mode increases executions per second.

How do I triage and minimize fuzzing crashes?▼

Minimize inputs with afl-tmin, symbolize with ASAN_OPTIONS=abort_on_error=1:symbolize=1, then bucket crashes by coverage hash and sanitizer log. On Linux use gdb with core dumps and addr2line; on Windows enable LocalDumps and PageHeap.

Related Skills

Explore More Software Engineering Skills→
GeneralReasoningGeneralReasoning
4

syzlang-ioctl-basics

Describe Linux ioctl syscalls using syzlang syntax patterns.

Official
Basic
karenrebecagkarenrebecag

crash-analysis

Analyzes crash dumps and assesses exploitability using WinDbg, GDB, and sanitizers.

Community
Advanced
SnailSploitSnailSploit
2.9k

bug-identification

Identify software vulnerabilities through static analysis, dynamic analysis, fuzzing, and AI-assisted techniques.

Community
Advanced
ArabelaTsoArabelaTso
142

symbolic-execution-assistant

Performs symbolic execution analysis on code to detect errors and generate test inputs.

Community
Advanced