I have some questions about the AFL Fuzzer:
- How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?
- As I understood, if I put all test cases in the input directory it knows to build randomly injections based on that input, yes?
- I saw a video shows that if for instance there are two inputs in the code, so in the test case each line is for each input. Is that correct? Since I want put a full message (for example HTTP request) into one variable, so how do I do it ?
- I have compiled everything correctly but for some reason it does not find any new paths. In addition, if I do not put the
-m noneI get the following error : "Fork server crashed with signal 6". - I don't understand when to put
@@.
fork()keeps the full state of the program prior to thefork()and so it's relatively cheap to follow different execution paths simply by mutating the input as it goes. The author of AFL even provides a corpus of image files generated by AFL "from thin air" simply by fuzzing some image processing tool and generating/mutating input for it.