skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offensive-fuzzing

Guides fuzzing campaign setup, execution, and crash triage across binaries, kernels, and parsers.

Updated Sep 17, 2026
Search Tags:#sanitizers#vulnerability research#fuzzing#libfuzzer#afl++#crash triage#syzkaller
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-fuzzing-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-fuzzing
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-fuzzing
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-fuzzing-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Finding memory-safety and logic bugs through manual testing is slow and misses deep code paths; this Skill provides a complete methodology for setting up coverage-guided fuzzing campaigns that automatically discover crashes in parsers, kernels, drivers, and language runtimes. ## Core Features & Use Cases - Fuzzer Selection & Setup: Choose between AFL++, libFuzzer, Honggfuzz, syzkaller, wtf, and snapshot fuzzers based on target type, with ready build commands for ASan, UBSan, CmpLog, and QEMU binary-only modes. - Harness Writing & Corpus Curation: Templates for libFuzzer, HF_ITER persistent mode, AFL++ __AFL_LOOP, IOCTL and FilterConnectionPort fuzzing, plus seed minimization with afl-cmin and afl-tmin. - Crash Triage & Specialized Targets: Symbolization, bucketing, and deduplication workflows, plus dedicated guidance for Linux kernel (syzkaller), Windows EDR engines, Rust, embedded firmware, and CI/CD integration with ClusterFuzzLite. - Use Case: A security researcher auditing a file parser builds an AFL++ instrumented target, seeds it with minimized samples, runs a parallel fuzz campaign with CmpLog secondaries, and triages the resulting crashes into deduplicated, symbolized bug reports. ## Quick Start Ask the assistant to help set up an AFL++ fuzzing campaign with harness, seed corpus, and crash triage for your target binary or parser.

Frequently Asked Questions about offensive-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up an AFL++ fuzzing campaign?▼

Build the target with afl-clang-fast, write a harness or use persistent mode with __AFL_LOOP, minimize a seed corpus with afl-cmin, then launch a primary instance with afl-fuzz -M and secondary instances with -S and CmpLog enabled via -c 0.

AFL++ vs libFuzzer vs Honggfuzz: which fuzzer should I use?▼

libFuzzer runs in-process and suits source-available libraries, AFL++ handles general greybox fuzzing with CmpLog and MOpt, and Honggfuzz offers Intel PT hardware tracing and the HF_ITER persistent API. Ensemble runs combining all three give the best coverage.

How do I fuzz a Linux kernel module with syzkaller?▼

Configure a syzkaller JSON with your kernel object, rootfs image, and QEMU VM settings, then restrict enable_syscalls to the target subsystem. Enable CONFIG_KASAN and CONFIG_KCFI, and use syz-extract to pull constants for custom modules.

Can I fuzz closed-source binaries without source code?▼

Yes, use AFL++ QEMU mode with the -Q flag for binary-only fuzzing, snapshot fuzzers like Nyx or wtf for high throughput, or QASAN and Retrowrite to add address sanitization and coverage through binary rewriting.

Why is my fuzzing campaign not finding new coverage?▼

Stalled progress usually means hard comparisons block the mutator. Enable CmpLog on AFL++ secondaries, add a dictionary with -x, switch to directed fuzzing with AFLGo, or use concolic execution with QSYM to solve difficult branches.

How do I triage and deduplicate fuzzing crashes?▼

Minimize each crash with afl-tmin, symbolize it with ASAN_OPTIONS=abort_on_error=1:symbolize=1, then bucket crashes by coverage hash and stack trace. Tools like AFLTriage automate this deduplication at scale.

Related Skills

Explore More Software Engineering Skills→
opensage-agentopensage-agent
113

fuzz

Automate AFL++ fuzzing campaigns with custom mutators and crash extraction.

Official
Advanced
MaelwalserMaelwalser

security-bounty-hunter

Scan code repositories for exploitable vulnerabilities and produce concise reports with proof-of-concept.

Community
Intermediate
SensLiaoSensLiao

security-app-fuzzing

Run coverage-guided fuzzing across multiple languages with ClusterFuzzLite CI integration.

Community
Advanced
ArabelaTsoArabelaTso
142

symbolic-execution-assistant

Performs symbolic execution analysis on code to detect errors and generate test inputs.

Community
Advanced