offensive-fuzzing

To start fuzzing a file parser, choose a fuzzing engine like AFL++ or libFuzzer, write a minimal harness to feed inputs to the target, curate an initial corpus, and execute the campaign to generate crashes for triage.

For network services, Boofuzz is effective, while syzkaller is suited for kernel modules. AFL++, libFuzzer, and Honggfuzz are versatile options for runtimes and file parsers, depending on your specific target architecture.

Manage a fuzzing corpus by curating diverse seed inputs, applying mutation strategies, and monitoring coverage metrics. This drives efficient testing by guiding the fuzzer toward unexplored code paths and new crashes.

Write a fuzzing harness by scaffolding a minimal wrapper that passes fuzzer-generated inputs directly into the target's entry point. The skill provides harness scaffolding guidance for engines like AFL++, libFuzzer, and Honggfuzz.

Yes, this fuzzing approach is applicable across file parsers, network services, kernel modules, and language runtimes, enabling systematic discovery of crashes and reliability issues in diverse software environments.

Crash triage involves analyzing the crashes generated during the fuzzing campaign to identify unique vulnerabilities. The skill automates systematic crash triage to help you expose and document software vulnerabilities efficiently.