Fuzzing Attack

--- name: offensive-fuzzing description: "A practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes." --- # Offensive Fuzzing ## Fuzzer Types | Type | Coverage | Speed | Tools | |------|----------|-------|-------| | BlackBox | Poor | Fast | Peach, Boofuzz | | GreyBox | Good | Fast | AFL++, Honggfuzz, libFuzzer, WinAFL | | Snapshot | Good | Fastest | Nyx, wtf, Snapchange | | WhiteBox | Best | Slow | KLEE, QSYM, SymSan | | Ensemble | Best | Fast | AFL++ + Honggfuzz + libFuzzer | GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf). ## Core Workflow `` Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report ` ### 1. Research Target - Map all input surfaces (files, network, IPC, syscalls, IOCTL) - Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points - For kernel modules: look beyond copyfromuser : DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks ### 2. Instrument and Build `bash # AFL++ (preferred for GreyBox) CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j # libFuzzer + ASan/UBSan (C/C++) cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" .. # CmpLog build for hard compares AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all ` **Windows (MSVC):** Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize =address) ### 3. Write Harness **libFuzzer (C++):** cpp #include <cstdint> #include <cstddef> extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { parse_or_process(data, size); return 0; } **Honggfuzz HF_ITER (persistent mode : preferred for large targets):** cpp #include "honggfuzz.h" int main(int argc, char** argv) { initialize_target(); // runs once for (;;) { size_t len; uint8_t *buf; HF_ITER(&buf, &len); FILE* s = fmemopen(buf, len, "r"); target_function(s); fclose(s); reset_target_state(); } } **AFL++ persistent mode ( _AFLLOOP ):** cpp while (__AFL_LOOP(10000)) { // re-read input and process } **macOS IPC (Mach message fuzzing):** c void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY); pFunction = dlsym(lib_handle, "DesiredFunction"); ### 4. Build Seed Corpus - Pull from target's test suite, bug reports, and real-world samples - Web-crawl (Common Crawl) for file formats; filter by MIME type - Minimize: afl-cmin -i raw_corpus -o seeds -- ./target @@ - Trim inputs: afl-tmin -i crash -o crash.min -- ./target @@ ### 5. Launch Fuzzing **AFL++ parallel (primary + secondary with cmplog):** bash afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@ afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@ **libFuzzer:** bash ./target_libfuzzer corpus/ -max_total_time=3600 -workers=4 **Binary-only (QEMU):** bash afl-fuzz -Q -i seeds -o findings -- target.exe @@ **Snapshot (AFL++ Nyx):** bash NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@ **Ensemble (AFL++ + Honggfuzz sharing corpus):** bash # Terminal 1 afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@ # Terminal 2 ../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \ --linux_perf_ipt_block -t 10 -- ./target ___FILE___ ### 6. Monitor and Unstick If progress stalls: - Enable CmpLog: -c 0 on AFL++ secondaries - Add dictionary: -x dict.txt or AFLTOKENFILE - Switch to directed fuzzing (AFLGo) targeting specific BBs/functions - Use concolic assistance (QSYM, Driller) on hard branches - Snapshot the target to increase exec/s - AFLMAPSIZE =1048576 , -L 0` for MOpt schedu