Offensive Fuzzing

Fuzzer Types

Type	Coverage	Speed	Tools
BlackBox	Poor	Fast	Peach, Boofuzz
GreyBox	Good	Fast	AFL++, Honggfuzz, libFuzzer, WinAFL
Snapshot	Good	Fastest	Nyx, wtf, Snapchange
WhiteBox	Best	Slow	KLEE, QSYM, SymSan
Ensemble	Best	Fast	AFL++ + Honggfuzz + libFuzzer

GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).

Core Workflow

Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report

1. Research Target

• Map all input surfaces (files, network, IPC, syscalls, IOCTL)
• Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
• For kernel modules: look beyond copy_from_user, DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks

2. Instrument and Build

# AFL++ (preferred for GreyBox)
CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j

# libFuzzer + ASan/UBSan (C/C++)
cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..

# CmpLog build for hard compares
AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all

Windows (MSVC): Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)

3. Write Harness

libFuzzer (C++):

#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    parse_or_process(data, size);
    return 0;
}