offensive-fuzzing

Offensive Fuzzing

Fuzzer Types

Type	Coverage	Speed	Tools
BlackBox	Poor	Fast	Peach, Boofuzz
GreyBox	Good	Fast	AFL++, Honggfuzz, libFuzzer, WinAFL
Snapshot	Good	Fastest	Nyx, wtf, Snapchange
WhiteBox	Best	Slow	KLEE, QSYM, SymSan
Ensemble	Best	Fast	AFL++ + Honggfuzz + libFuzzer

GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).

Core Workflow

Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report

1. Research Target

• Map all input surfaces (files, network, IPC, syscalls, IOCTL)
• Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
• For kernel modules: look beyond copy_from_user — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks

2. Instrument and Build

# AFL++ (preferred for GreyBox)
CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j

# libFuzzer + ASan/UBSan (C/C++)
cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..

# CmpLog build for hard compares
AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all

Windows (MSVC): Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)

3. Write Harness

libFuzzer (C++):

#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    parse_or_process(data, size);
    return 0;
}

Honggfuzz HF_ITER (persistent mode — preferred for large targets):

#include "honggfuzz.h"
int main(int argc, char** argv) {
    initialize_target(); // runs once
    for (;;) {
        size_t len; uint8_t *buf;
        HF_ITER(&buf, &len);
        FILE* s = fmemopen(buf, len, "r");
        target_function(s);
        fclose(s);
        reset_target_state();
    }
}