offensive-fuzzing

1# Offensive Fuzzing
2 
3## Fuzzer Types
4 
5| Type | Coverage | Speed | Tools |
6|------|----------|-------|-------|
7| BlackBox | Poor | Fast | Peach, Boofuzz |
8| GreyBox | Good | Fast | AFL++, Honggfuzz, libFuzzer, WinAFL |
9| Snapshot | Good | Fastest | Nyx, wtf, Snapchange |
10| WhiteBox | Best | Slow | KLEE, QSYM, SymSan |
11| Ensemble | Best | Fast | AFL++ + Honggfuzz + libFuzzer |
12 
13**GreyBox sub-variants:** Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).
14 
15## Core Workflow
16 
17```
18Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report
19```
20 
21### 1. Research Target
22 
23- Map all input surfaces (files, network, IPC, syscalls, IOCTL)
24- Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
25- For kernel modules: look beyond `copy_from_user` — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks
26 
27### 2. Instrument and Build
28 
29```bash
30# AFL++ (preferred for GreyBox)
31CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j
32 
33# libFuzzer + ASan/UBSan (C/C++)
34cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..
35 
36# CmpLog build for hard compares
37AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all
38```
39 
40**Windows (MSVC):** `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`
41 
42### 3. Write Harness
43 
44**libFuzzer (C++):**
45…