Performing Fuzzing Campaigns

name: performing-fuzzing-campaigns description: >- Execute coverage-guided fuzzing campaigns with AFL++, libFuzzer, and honggfuzz to discover memory corruption vulnerabilities, triage crashes, and minimize test cases for exploit development. domain: cybersecurity subdomain: exploit-development tags: - afl-plus-plus - libfuzzer - honggfuzz - fuzzing - crash-triage - coverage version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190", "T1203"] frameworks: ["MITRE ATT&CK", "Metasploit"] tools: ["afl-fuzz", "afl-clang-fast", "libfuzzer", "honggfuzz", "gdb"]

Performing Fuzzing Campaigns

Overview

Coverage-guided fuzzing systematically discovers memory corruption by mutating inputs and tracking code coverage. AFL++, libFuzzer, and honggfuzz find crashes that become exploit primitives — stack overflows, heap corruption, use-after-free.

Prerequisites

Workflow

Step 1: Instrumentation and Compilation

# AFL++ instrumented build
export CC=afl-clang-fast
export CXX=afl-clang-fast++
export AFL_USE_ASAN=1
./configure --disable-shared && make clean && make -j$(nproc)

# libFuzzer harness compilation
clang -g -O1 -fsanitize=fuzzer,address -o fuzz_target harness.c target.c

# honggfuzz build
hfuzz-clang -g -O1 -fsanitize=address -o hfuzz_target target.c

Step 2: Seed Corpus Preparation

# Create minimal seed corpus
mkdir -p seeds/
echo -n "AAAA" > seeds/minimal.txt

# Minimize existing corpus
afl-cmin -i raw_corpus/ -o seeds/ -- ./target_binary @@

# Trim individual test cases
afl-tmin -i seeds/large_input.txt -o seeds/trimmed.txt -- ./target_binary @@

Step 3: Campaign Execution

# Single-core AFL++ campaign
afl-fuzz -i seeds/ -o findings/ -m none -t 1000 -- ./target_binary @@

# Multi-core parallel fuzzing
afl-fuzz -i seeds/ -o findings/ -M main -- ./target_binary @@
afl-fuzz -i seeds/ -o findings/ -S worker01 -- ./target_binary @@
afl-fuzz -i seeds/ -o findings/ -S worker02 -- ./target_binary @@

# libFuzzer campaign
./fuzz_target corpus/ -max_len=4096 -jobs=$(nproc) -workers=$(nproc)

# honggfuzz campaign
honggfuzz -i seeds/ -o findings/ --threads $(nproc) -- ./hfuzz_target ___FILE___

Step 4: Crash Triage

# Deduplicate and triage AFL++ crashes
afl-collect -d findings/ -e ./target_binary -r crashes_triaged/

# Analyze crash with GDB
gdb -batch -ex "run < findings/crashes/id:000000,sig:11" \
  -ex "bt full" -ex "info registers" ./target_binary

# Classify with AddressSanitizer
ASAN_OPTIONS=symbolize=1 ./target_binary < findings/crashes/id:000000,sig:11

# Agent-assisted triage
node scripts/agent.js triage --findings findings/crashes/ --binary ./target_binary

Step 5: Campaign Monitoring

# Check AFL++ stats
afl-whatsup -s findings/

# Plot coverage over time
afl-plot findings/ plot_output/

# Agent campaign status
node scripts/agent.js status --campaign findings/

Detection

title: Fuzzing Campaigns Detection
id: 7ec0f782-ea04-4b01-a189-27845ab0c1a4
status: experimental
description: Detects suspicious activity related to performing fuzzing campaigns techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*fuzzing*"
  condition: selection
level: critical
tags:
  - attack.t1190
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures

Detection Opportunities

Verification

• Target compiled with sanitizers (ASAN/UBSAN) and coverage instrumentation
• Seed corpus minimized and validated
• Campaign ran for sufficient duration (24h+ recommended)
• All unique crashes triaged and classified
• Exploitable crashes prioritized for exploit development
• Coverage metrics show thorough code exploration

References

• AFL++ — Coverage-guided fuzzing framework
• libFuzzer — In-process coverage-guided fuzzer
• honggfuzz — Security-oriented software fuzzer