Fuzzing with AFL
summary
Introduces practical AFL usage: compile with AFL instrumentation (AFL_INST_RATIO=100), run master plus three slaves on a rented Hetzner box (€20/mo), seed and minimize a corpus with afl-cmin, aim for 500–1,000+ execs/sec, use dictionaries, forkserver/persistent mode and libdislocator to make bugs crash faster. Demonstrates fuzzing a sass compiler, finds thousands of paths (one run >4,000), produces crashes triaged with gdb + exploitable and ASAN so real, exploitable bugs can be confirmed.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:34Inspiration
- 2:21Code coverage vs path coverage
- 3:22Basic fuzzing
- 3:52Mutational fuzzer
- 4:27Grammar fuzzer
- 5:14Feedback-based fuzzers
- 6:55AFL trophy case - vulnerabilities
- 8:04Installing AFL
- 8:30LLVM: Fuzzing non-x86
- 8:49Workflow
- 9:16Get some hardware
- 10:36Compile the binary
- 10:46Compile time environment variables
- 11:33Find a test corpus
- 12:35Run the fuzzer
- 15:41Triage the findings
- 16:49Profit
- 25:45Goals
- 26:03Optimization: Execution speed
- 26:39Optimization: LLVM - Deferred instrumentation
- 27:21Optimization: LLVM - Persistent mode
- 27:56Optimization: libdislocator.so
- 29:17Optimization: Dictionaries
- 36:42Resources
- 37:23Summary
related talks
20mAFL++ : Combining Incremental Steps of Fuzzing Research
53mFuzzing 101
01h 15mMake your programs more reliable with Fuzzing
33mFuzzing Ruby and C Extensions
52mStructure aware fuzzing
25mHow fuzzing helps to find bugs
53mFuzz Testing for Fun and Profit
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels