These basic questions will help save a lot of time and headaches later if you are just starting out. If the project has unit tests with test cases of files (or keeps files with previously known bugs for regression testing), this is a huge win as well. We are probably going to be fuzzing a file format (although with some tuning, we can fuzz networked applications), and having some testcases to seed with that are unique and interesting will give us a good start.Are there easily available and unique testcases available?.In my ideal scenario, I can easily build the software with afl-clang-fast or afl-clang-fast++. It does support instrumenting black-box binaries on the fly with QEMU, but this is out of scope and tends to have poor performance. AFL works best when you are able to build the software from source.Can I compile it myself? (Is the build system sane?).If a project has bare-bones example code, this makes our lives as fuzzers much easier. Chances are, any utilities shipped with the project are too heavy-weight and can be trimmed down for fuzzing purposes.Is there example code readily available?.There are a few questions we can ask ourselves when looking for software to fuzz. What should I fuzz? Finding the right softwareĪFL works best on C or C++ applications, so immediately this is a piece of criteria we should be looking for in software we would like to fuzz. For ease of use, we will focus on the AFL framework. We hope to cover all of this to give a fully-colored, 360 view of how to effectively and efficiently go through a full fuzz job process from start to finish.

Once we have the software, what’s the best way to fuzz it? What about which testcases we should use to seed with? How do we know how well we are doing or what code paths we might be missing in the target software? What does this mean exactly? First, even finding a good piece of software to fuzz might seem daunting, but there is certain criteria that you can follow that can help you decide what would be useful and easy to get started with on fuzzing. In this post, we’d like to go over a fuzz job from start to finish. Many websites on the internet give brief introductions to specific features of AFL, how to start fuzzing a given piece of software, but never what to do when you decide to stop fuzzing (or how you decide in the first place?). By people have garnered an interest in fuzzing in the recent years, with easy-to-use frameworks like American Fuzzy Lop showing incredible promise and (relatively) low barrier to entry.

Afl qemu mode tutorial