Agent skill
performing-fuzzing-campaigns
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/performing-fuzzing-campaigns
SKILL.md
name: performing-fuzzing-campaigns description: >- Execute coverage-guided fuzzing campaigns with AFL++, libFuzzer, and honggfuzz to discover memory corruption vulnerabilities, triage crashes, and minimize test cases for exploit development. domain: cybersecurity subdomain: exploit-development tags:
- afl-plus-plus
- libfuzzer
- honggfuzz
- fuzzing
- crash-triage
- coverage version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1190", "T1203"] frameworks: ["MITRE ATT&CK", "Metasploit"] tools: ["afl-fuzz", "afl-clang-fast", "libfuzzer", "honggfuzz", "gdb"]
Performing Fuzzing Campaigns
Overview
Coverage-guided fuzzing systematically discovers memory corruption by mutating inputs and tracking code coverage. AFL++, libFuzzer, and honggfuzz find crashes that become exploit primitives — stack overflows, heap corruption, use-after-free.
Prerequisites
| Tool / Requirement | Details |
|---|---|
afl-fuzz (AFL++) |
Security tooling |
clang with libFuzzer |
Security tooling |
honggfuzz |
Security tooling |
| Target source code or binary for instrumentation | Environment requirement |
| Seed corpus of valid inputs | Environment requirement |
| Sufficient disk and CPU for campaign duration | Environment requirement |
Workflow
Step 1: Instrumentation and Compilation
# AFL++ instrumented build
export CC=afl-clang-fast
export CXX=afl-clang-fast++
export AFL_USE_ASAN=1
./configure --disable-shared && make clean && make -j$(nproc)
# libFuzzer harness compilation
clang -g -O1 -fsanitize=fuzzer,address -o fuzz_target harness.c target.c
# honggfuzz build
hfuzz-clang -g -O1 -fsanitize=address -o hfuzz_target target.c
Step 2: Seed Corpus Preparation
# Create minimal seed corpus
mkdir -p seeds/
echo -n "AAAA" > seeds/minimal.txt
# Minimize existing corpus
afl-cmin -i raw_corpus/ -o seeds/ -- ./target_binary @@
# Trim individual test cases
afl-tmin -i seeds/large_input.txt -o seeds/trimmed.txt -- ./target_binary @@
Step 3: Campaign Execution
# Single-core AFL++ campaign
afl-fuzz -i seeds/ -o findings/ -m none -t 1000 -- ./target_binary @@
# Multi-core parallel fuzzing
afl-fuzz -i seeds/ -o findings/ -M main -- ./target_binary @@
afl-fuzz -i seeds/ -o findings/ -S worker01 -- ./target_binary @@
afl-fuzz -i seeds/ -o findings/ -S worker02 -- ./target_binary @@
# libFuzzer campaign
./fuzz_target corpus/ -max_len=4096 -jobs=$(nproc) -workers=$(nproc)
# honggfuzz campaign
honggfuzz -i seeds/ -o findings/ --threads $(nproc) -- ./hfuzz_target ___FILE___
Step 4: Crash Triage
# Deduplicate and triage AFL++ crashes
afl-collect -d findings/ -e ./target_binary -r crashes_triaged/
# Analyze crash with GDB
gdb -batch -ex "run < findings/crashes/id:000000,sig:11" \
-ex "bt full" -ex "info registers" ./target_binary
# Classify with AddressSanitizer
ASAN_OPTIONS=symbolize=1 ./target_binary < findings/crashes/id:000000,sig:11
# Agent-assisted triage
node scripts/agent.js triage --findings findings/crashes/ --binary ./target_binary
Step 5: Campaign Monitoring
# Check AFL++ stats
afl-whatsup -s findings/
# Plot coverage over time
afl-plot findings/ plot_output/
# Agent campaign status
node scripts/agent.js status --campaign findings/
Detection
title: Fuzzing Campaigns Detection
id: 7ec0f782-ea04-4b01-a189-27845ab0c1a4
status: experimental
description: Detects suspicious activity related to performing fuzzing campaigns techniques in exploit development context
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine: "*performing*fuzzing*"
condition: selection
level: critical
tags:
- attack.t1190
- attack.t1203
- attack.execution
falsepositives:
- Vulnerability scanner testing known exploit signatures
Detection Opportunities
| Indicator | Source | Detection Logic |
|---|---|---|
| Fuzzing Campaigns Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1203 |
Verification
- Target compiled with sanitizers (ASAN/UBSAN) and coverage instrumentation
- Seed corpus minimized and validated
- Campaign ran for sufficient duration (24h+ recommended)
- All unique crashes triaged and classified
- Exploitable crashes prioritized for exploit development
- Coverage metrics show thorough code exploration
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?