offensive-fuzzing

# Offensive Fuzzing ## Fuzzer Types | Type | Coverage | Speed | Tools | |------|----------|-------|-------| | BlackBox | Poor | Fast | Peach, Boofuzz | | GreyBox | Good | Fast | AFL++, Honggfuzz, libFuzzer, WinAFL | | Snapshot | Good | Fastest | Nyx, wtf, Snapchange | | WhiteBox | Best | Slow | KLEE, QSYM, SymSan | | Ensemble | Best | Fast | AFL++ + Honggfuzz + libFuzzer | **GreyBox sub-variants:** Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf). ## Core Workflow ``` Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report ``` ### 1. Research Target - Map all input surfaces (files, network, IPC, syscalls, IOCTL) - Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points - For kernel modules: look beyond `copy_from_user` — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks ### 2. Instrument and Build ```bash # AFL++ (preferred for GreyBox) CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j # libFuzzer + ASan/UBSan (C/C++) cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" .. # CmpLog build for hard compares AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all ``` **Windows (MSVC):** `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)` ### 3. Write Harness **libFuzzer (C++):** `...