offensive-fuzzing-course

Install LLVM and build AFL++ from source, then compile your target with afl-clang-fast to add instrumentation. Create a seed corpus, set the core pattern with echo core, and run afl-fuzz with -i for inputs and -o for findings.

AFL++ fuzzes whole programs as separate processes using file-based inputs, while libFuzzer runs in-process against a specific function harness. AFL++ suits black-box binaries; libFuzzer and FuzzTest are faster for library code where you control the source.

Minimize each crashing input with afl-tmin while preserving the crash, then cluster crashes with casr-afl to group unique stack traces. Analyze the minimized cases in GDB with GEF to determine root cause and exploitability.

Real targets often require hours or days of fuzzing before crashes appear. Improve results by using a valid minimized seed corpus, enabling ASan and UBSan, adding a format dictionary, and running parallel master and slave instances.

Use FuzzTest when you have C++ source code and want to fuzz individual functions alongside GoogleTest unit tests. It is ideal for parsers and core logic in CI pipelines, while AFL++ fits whole-program or black-box fuzzing.

Yes, valid diverse seeds let the fuzzer reach deep parsing logic instead of failing early validation. Minimize the corpus with afl-cmin and shrink individual files with afl-tmin to keep coverage while speeding up iterations.