How do I install the Performing Fuzzing With Aflplusplus skill?

Run npx skillmds@latest add xalgord/performing-fuzzing-with-aflplusplus in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Performing Fuzzing With Aflplusplus safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Performing Fuzzing With Aflplusplus?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Performing Fuzzing With Aflplusplus free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Performing Fuzzing With Aflplusplus?

xalgord (@xalgord) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Performing Fuzzing With Aflplusplus by xalgord

Name: Performing Fuzzing With Aflplusplus
Author: xalgord

Performing Fuzzing With Aflplusplus

Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.

xalgord 9285dcf 3.6 KB Updated Sep 17, 2026

File contents

Performing Fuzzing with AFL++

Overview

AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving, and persistent mode for high-throughput fuzzing.

When to Use

When conducting security assessments that involve performing fuzzing with aflplusplus
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Common Misconfigurations & Verification

A campaign that runs for hours with zero crashes is usually a setup problem, not a secure target.

No sanitizer, so bugs go silent: instrument with AFL_USE_ASAN=1 afl-cc (or afl-clang-fast). Without ASAN/UBSAN a heap overflow corrupts memory without crashing and AFL++ never flags it.
Empty or trivial seed corpus: starting -i with one tiny file leaves the fuzzer unable to reach parser logic. Provide diverse valid inputs, then prune with afl-cmin, and shrink each with afl-tmin.
No dictionary for structured formats: without -x dict/ (magic bytes, keywords, tokens) AFL++ wastes cycles guessing format headers. Supply a format dictionary.
Single-core run wastes the box: use -M main + several -S sec1 sec2 ... secondaries to fuzz in parallel and share finds via the sync dir.
Coverage stall ignored: map density flat and pending near zero for hours means saturation — add CMPLOG (-c), MOpt, or new seeds rather than letting it spin.

Verify the harness can actually find bugs: compile a build with a planted bug (e.g. an unchecked strcpy on input) and confirm AFL++ surfaces it in crashes/ within minutes and that afl-tmin + CASR/GDB reproduce it. If the planted bug is never found, fix instrumentation/seeds before trusting a clean run.

Prerequisites

AFL++ installed (apt install afl++ or build from source)
Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only
Initial seed corpus of valid inputs for the target format
Linux system with /proc/sys/kernel/core_pattern configured

Steps

Instrument the target binary with afl-cc or afl-clang-fast
Prepare seed corpus directory with minimal valid inputs
Minimize corpus with afl-cmin to remove redundant seeds
Run afl-fuzz with appropriate flags (-i input -o output)
Monitor fuzzing progress via afl-whatsup and UI stats
Triage crashes with afl-tmin minimization and CASR/GDB analysis
Report unique crashes with reproduction steps

Expected Output

+++ Findings +++
  unique crashes: 12
  unique hangs: 3
  last crash: 00:02:15 ago
+++ Coverage +++
  map density: 4.23% / 8.41%
  paths found: 1847
  exec speed: 2145/sec

---name: performing-fuzzing-with-aflplusplusdescription: Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.license: Apache-2.0---# Performing Fuzzing with AFL++## OverviewAFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guidedfuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn modefor binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includesadvanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving,and persistent mode for high-throughput fuzzing.## When to Use- When conducting security assessments that involve performing fuzzing with aflplusplus- When following incident response procedures for related security events- When performing scheduled security testing or auditing activities- When validating security controls through hands-on testing## Common Misconfigurations & VerificationA campaign that runs for hours with zero crashes is usually a setup problem, not a secure target.- **No sanitizer, so bugs go silent:** instrument with `AFL_USE_ASAN=1 afl-cc` (or `afl-clang-fast`). Without ASAN/UBSAN a heap overflow corrupts memory without crashing and AFL++ never flags it.- **Empty or trivial seed corpus:** starting `-i` with one tiny file leaves the fuzzer unable to reach parser logic. Provide diverse valid inputs, then prune with `afl-cmin`, and shrink each with `afl-tmin`.- **No dictionary for structured formats:** without `-x dict/` (magic bytes, keywords, tokens) AFL++ wastes cycles guessing format headers. Supply a format dictionary.- **Single-core run wastes the box:** use `-M main` + several `-S sec1 sec2 ...` secondaries to fuzz in parallel and share finds via the sync dir.- **Coverage stall ignored:** `map density` flat and `pending` near zero for hours means saturation — add CMPLOG (`-c`), MOpt, or new seeds rather than letting it spin.**Verify the harness can actually find bugs:** compile a build with a planted bug (e.g. an unchecked `strcpy` on input) and confirm AFL++ surfaces it in `crashes/` within minutes and that `afl-tmin` + CASR/GDB reproduce it. If the planted bug is never found, fix instrumentation/seeds before trusting a clean run.## Prerequisites- AFL++ installed (`apt install afl++` or build from source)- Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only- Initial seed corpus of valid inputs for the target format- Linux system with /proc/sys/kernel/core_pattern configured## Steps1. Instrument the target binary with `afl-cc` or `afl-clang-fast`2. Prepare seed corpus directory with minimal valid inputs3. Minimize corpus with `afl-cmin` to remove redundant seeds4. Run `afl-fuzz` with appropriate flags (-i input -o output)5. Monitor fuzzing progress via afl-whatsup and UI stats6. Triage crashes with `afl-tmin` minimization and CASR/GDB analysis7. Report unique crashes with reproduction steps## Expected Output```+++ Findings +++ unique crashes: 12 unique hangs: 3 last crash: 00:02:15 ago+++ Coverage +++ map density: 4.23% / 8.41% paths found: 1847 exec speed: 2145/sec```

Frequently asked questions