offensive-fuzzing

Name: offensive-fuzzing
Author: SnailSploit

44installs447forks

How to install offensive-fuzzing?

snailsploit/claude-red/offensive-fuzzing

$npx -y skills add SnailSploit/Claude-Red --skill offensive-fuzzing

Installs into the current project.

Summary

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns

Files · 1

View on GitHub

SKILL.md

1	# Offensive Fuzzing
2
3	## Fuzzer Types
4
5	\| Type \| Coverage \| Speed \| Tools \|
6	\|------\|----------\|-------\|-------\|
7	\| BlackBox \| Poor \| Fast \| Peach, Boofuzz \|
8	\| GreyBox \| Good \| Fast \| AFL++, Honggfuzz, libFuzzer, WinAFL \|
9	\| Snapshot \| Good \| Fastest \| Nyx, wtf, Snapchange \|
10	\| WhiteBox \| Best \| Slow \| KLEE, QSYM, SymSan \|
11	\| Ensemble \| Best \| Fast \| AFL++ + Honggfuzz + libFuzzer \|
12
13	GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).
14
15	## Core Workflow
16
17	```
18	Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report
19	```
20
21	### 1. Research Target
22
23	- Map all input surfaces (files, network, IPC, syscalls, IOCTL)
24	- Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
25	- For kernel modules: look beyond `copy_from_user` — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks
26
27	### 2. Instrument and Build
28
29	```bash
30	# AFL++ (preferred for GreyBox)
31	CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j
32
33	# libFuzzer + ASan/UBSan (C/C++)
34	cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..
35
36	# CmpLog build for hard compares
37	AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all
38	```
39
40	Windows (MSVC): `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`
41
42	### 3. Write Harness
43
44	libFuzzer (C++):
45	```cpp
46	#include <cstdint>
47	#include <cstddef>
48	extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
49	parse_or_process(data, size);
50	return 0;
51	}
52	```
53
54	Honggfuzz HF_ITER (persistent mode — preferred for large targets):
55	```cpp
56	#include "honggfuzz.h"
57	int main(int argc, char** argv) {
58	initialize_target(); // runs once
59	for (;;) {
60	size_t len; uint8_t *buf;
61	HF_ITER(&buf, &len);
62	FILE* s = fmemopen(buf, len, "r");
63	target_function(s);
64	fclose(s);
65	reset_target_state();
66	}
67	}
68	```
69
70	AFL++ persistent mode (`__AFL_LOOP`):
71	```cpp
72	while (__AFL_LOOP(10000)) {
73	// re-read input and process
74	}
75	```
76
77	macOS IPC (Mach message fuzzing):
78	```c
79	void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
80	pFunction = dlsym(lib_handle, "DesiredFunction");
81	```
82
83	### 4. Build Seed Corpus
84
85	- Pull from target's test suite, bug reports, and real-world samples
86	- Web-crawl (Common Crawl) for file formats; filter by MIME type
87	- Minimize: `afl-cmin -i raw_corpus -o seeds -- ./target @@`
88	- Trim inputs: `afl-tmin -i crash -o crash.min -- ./target @@`
89
90	### 5. Launch Fuzzing
91
92	AFL++ parallel (primary + secondary with cmplog):
93	```bash
94	afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
95	afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@
96	```
97
98	libFuzzer:
99	```bash
100	./target_libfuzzer corpus/ -max_total_time=3600 -workers=4
101	```
102
103	Binary-only (QEMU):
104	```bash
105	afl-fuzz -Q -i seeds -o findings -- target.exe @@
106	```
107
108	Snapshot (AFL++ Nyx):
109	```bash
110	NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@
111	```
112
113	Ensemble (AFL++ + Honggfuzz sharing corpus):
114	```bash
115	# Terminal 1
116	afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@
117	# Terminal 2
118	../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \
119	--linux_perf_ipt_block -t 10 -- ./target ___FILE___
120	```
121
122	### 6. Monitor and Unstick
123
124	If progress stalls:
125	- Enable CmpLog: `-c 0` on AFL++ secondaries
126	- Add dictionary: `-x dict.txt` or `AFL_TOKEN_FILE`
127	- Switch to directed fuzzing (AFLGo) targeting specific BBs/functions
128	- Use concolic assistance (QSYM, Driller) on hard branches
129	- Snapshot the target to increase exec/s
130	- `AFL_MAP_SIZE=1048576`, `-L 0` for MOpt scheduler
131
132	### 7. Triage Crashes
133
134	```bash
135	# 1. Minimize
136	afl-tmin -i crash -o crash.min -- ./target @@
137	# 2. Symbolize
138	ASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log
139	# 3. Hash + bucket
140	./cov-tool --bbids ./target crash.min > cov.hash
141	./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/
142	```
143
144	Sanitizer env quick reference:
145	```
146	ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1
147	UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1
148	TSAN_OPTIONS=halt_on_error=1:history_size=7
149	MSAN_OPTIONS=poison_in_dtor=1:track_origins=2
150	```
151
152	## Oracle Selection
153
154	\| Bug Class \| Oracle \|
155	\|-----------\|--------\|
156	\| Memory safety \| ASan, HWASan (AArch64, lower overhead) \|
157	\| Uninitialized reads \| MSan \|
158	\| Concurrency \| TSan \|
159	\| Undefined behavior \| UBSan \|
160	\| Type safe

People who liked this also viewed

6 picks

Type

offensive-fuzzing

44installs447forks

View on GitHub

How to install offensive-fuzzing?

snailsploit/claude-red/offensive-fuzzing

$npx -y skills add SnailSploit/Claude-Red --skill offensive-fuzzing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Offensive Fuzzing
2
3	## Fuzzer Types
4
5	\| Type \| Coverage \| Speed \| Tools \|
6	\|------\|----------\|-------\|-------\|
7	\| BlackBox \| Poor \| Fast \| Peach, Boofuzz \|
8	\| GreyBox \| Good \| Fast \| AFL++, Honggfuzz, libFuzzer, WinAFL \|
9	\| Snapshot \| Good \| Fastest \| Nyx, wtf, Snapchange \|
10	\| WhiteBox \| Best \| Slow \| KLEE, QSYM, SymSan \|
11	\| Ensemble \| Best \| Fast \| AFL++ + Honggfuzz + libFuzzer \|
12
13	GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).
14
15	## Core Workflow
16
17	```
18	Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report
19	```
20
21	### 1. Research Target
22
23	- Map all input surfaces (files, network, IPC, syscalls, IOCTL)
24	- Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
25	- For kernel modules: look beyond `copy_from_user` — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks
26
27	### 2. Instrument and Build
28
29	```bash
30	# AFL++ (preferred for GreyBox)
31	CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j
32
33	# libFuzzer + ASan/UBSan (C/C++)
34	cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..
35
36	# CmpLog build for hard compares
37	AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all
38	```
39
40	Windows (MSVC): `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`
41
42	### 3. Write Harness
43
44	libFuzzer (C++):
45	```cpp
46	#include <cstdint>
47	#include <cstddef>
48	extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
49	parse_or_process(data, size);
50	return 0;
51	}
52	```
53
54	Honggfuzz HF_ITER (persistent mode — preferred for large targets):
55	```cpp
56	#include "honggfuzz.h"
57	int main(int argc, char** argv) {
58	initialize_target(); // runs once
59	for (;;) {
60	size_t len; uint8_t *buf;
61	HF_ITER(&buf, &len);
62	FILE* s = fmemopen(buf, len, "r");
63	target_function(s);
64	fclose(s);
65	reset_target_state();
66	}
67	}
68	```
69
70	AFL++ persistent mode (`__AFL_LOOP`):
71	```cpp
72	while (__AFL_LOOP(10000)) {
73	// re-read input and process
74	}
75	```
76
77	macOS IPC (Mach message fuzzing):
78	```c
79	void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
80	pFunction = dlsym(lib_handle, "DesiredFunction");
81	```
82
83	### 4. Build Seed Corpus
84
85	- Pull from target's test suite, bug reports, and real-world samples
86	- Web-crawl (Common Crawl) for file formats; filter by MIME type
87	- Minimize: `afl-cmin -i raw_corpus -o seeds -- ./target @@`
88	- Trim inputs: `afl-tmin -i crash -o crash.min -- ./target @@`
89
90	### 5. Launch Fuzzing
91
92	AFL++ parallel (primary + secondary with cmplog):
93	```bash
94	afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
95	afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@
96	```
97
98	libFuzzer:
99	```bash
100	./target_libfuzzer corpus/ -max_total_time=3600 -workers=4
101	```
102
103	Binary-only (QEMU):
104	```bash
105	afl-fuzz -Q -i seeds -o findings -- target.exe @@
106	```
107
108	Snapshot (AFL++ Nyx):
109	```bash
110	NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@
111	```
112
113	Ensemble (AFL++ + Honggfuzz sharing corpus):
114	```bash
115	# Terminal 1
116	afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@
117	# Terminal 2
118	../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \
119	--linux_perf_ipt_block -t 10 -- ./target ___FILE___
120	```
121
122	### 6. Monitor and Unstick
123
124	If progress stalls:
125	- Enable CmpLog: `-c 0` on AFL++ secondaries
126	- Add dictionary: `-x dict.txt` or `AFL_TOKEN_FILE`
127	- Switch to directed fuzzing (AFLGo) targeting specific BBs/functions
128	- Use concolic assistance (QSYM, Driller) on hard branches
129	- Snapshot the target to increase exec/s
130	- `AFL_MAP_SIZE=1048576`, `-L 0` for MOpt scheduler
131
132	### 7. Triage Crashes
133
134	```bash
135	# 1. Minimize
136	afl-tmin -i crash -o crash.min -- ./target @@
137	# 2. Symbolize
138	ASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log
139	# 3. Hash + bucket
140	./cov-tool --bbids ./target crash.min > cov.hash
141	./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/
142	```
143
144	Sanitizer env quick reference:
145	```
146	ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1
147	UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1
148	TSAN_OPTIONS=halt_on_error=1:history_size=7
149	MSAN_OPTIONS=poison_in_dtor=1:track_origins=2
150	```
151
152	## Oracle Selection
153
154	\| Bug Class \| Oracle \|
155	\|-----------\|--------\|
156	\| Memory safety \| ASan, HWASan (AArch64, lower overhead) \|
157	\| Uninitialized reads \| MSan \|
158	\| Concurrency \| TSan \|
159	\| Undefined behavior \| UBSan \|
160	\| Type safe

People who liked this also viewed

6 picks

Type