Scripts and auxiliary files for fuzzing PHP's unserialize function
Shell PHP
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.

README.md

funserialize

Scripts and auxiliary files for fuzzing PHP's unserialize function. See https://sean.heelan.io/2017/08/12/fuzzing-phps-unserialize-function/ for details.

Dependencies

GNU screen

clang (optional)

Usage

get.sh retrieves the source for PHP and afl.

build.sh builds both PHP and afl. If you have clang available then afl-clang-fast will also be built.

fuzz.sh starts a master afl instance and multiple slaves inside a GNU screen instance with the session name fuzz.

A normal session might look as follows:

./get.sh

<...>

./build.sh

<...>

./fuzz.sh output_dir 3

<...>

The final command will start a master afl instance and 3 slaves, with output_dir used as the top level output directory for afl. You can run screen -r fuzz to attach to the screen instance and view the progress of the fuzzing session.