Skip to content
Exercises to learn how to fuzz with American Fuzzy Lop
C Dockerfile C++ Shell Makefile
Branch: master
Clone or download
mykter Merge pull request #10 from MashaSamoylova/master
quickstart/README.md: Work around for error in building LLVM mode
Latest commit fb78866 Jul 19, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
challenges libxml: how to avoid leak detection issues in docker Jun 21, 2019
docker Dockerfile: missing package Jun 4, 2019
harness Add overview diagram Jun 24, 2019
quickstart Update README.md Jul 19, 2019
.gitignore Change text files to markdown format Jul 3, 2017
.gitmodules date: use submodule Jun 4, 2019
LICENSE Initial SSM version for testing May 22, 2019
README.md README.md: update slides Jun 25, 2019

README.md

Fuzzing with AFL workshop

Materials of the "Fuzzing with AFL" workshop by Michael Macnair (@michael_macnair).

The first public version of this workshop was presented at SteelCon 2017 and it was revised for BSides London and Bristol 2019.

Pre-requisites

  • 3-4 hours (more to complete all the challenges)
  • Linux machine
  • Basic C and command line experience - ability to modify and compile C programs.
  • Docker, or the dependencies described in quickstart.

Contents

  • quickstart - Do this first! A tiny sample program to get started with fuzzing, including instructions on how to setup your machine.
  • harness - the basics of creating a test harness. Do this if you have any doubts about the "plumbing" between afl-fuzz and the target code.
  • challenges - a set of known-vulnerable programs with fuzzing hints
  • docker - Instructions and Dockerfile for preparing a suitable environment, and hosting it on AWS if you wish. A prebuilt image is on Docker Hub at mykter/afl-training.

See the other READMEs for more information.

Challenges

Challenges, roughly in recommended order, with any specific aspects they cover:

  • libxml2 - an ideal target, using ASAN and persistent mode.
  • heartbleed - infamous bug, using ASAN.
  • sendmail/1301 - parallel fuzzing
  • date - fuzzing environment variable input
  • ntpq - fuzzing a network client; coverage analysis and increasing coverage
  • cyber-grand-challenge - an easy vuln and an example of a hard to find vuln using afl
  • sendmail/1305 - persistent mode difficulties

The challenges have HINTS.md and ANSWERS.md files - these contain useful information about fuzzing different targets even if you're not going to attempt the challenge.

All of the challenges use real vulnerabilities from open source projects (the CVEs are identified in the descriptions), with the exception of the Cyber Grand Challenge extract, which is a synthetic vulnerability.

The chosen bugs are all fairly well isolated, and (except where noted) are very amenable to fuzzing. This means that you should be able to discover the bugs with a relatively small amount of compute time - these won't take core-days, most of them will take core-minutes. That said, fuzz testing is be definition a random process, so there's no guarantee how long it will take to find a particular bug, just a probability distribution.

Slides

Via Google slides and in PowerPoint format. There is extra information in the speaker notes.

Links

You can’t perform that action at this time.