2

I have some questions about the AFL Fuzzer:

  1. How does the AFL Fuzzer know where to inject the payload in the code I compile? For instance if I want to inject it in a specific parameter, how do I do it?
  2. As I understood, if I put all test cases in the input directory it knows to build randomly injections based on that input, yes?
  3. I saw a video shows that if for instance there are two inputs in the code, so in the test case each line is for each input. Is that correct? Since I want put a full message (for example HTTP request) into one variable, so how do I do it ?
  4. I have compiled everything correctly but for some reason it does not find any new paths. In addition, if I do not put the -m none I get the following error : "Fork server crashed with signal 6".
  5. I don't understand when to put @@.
Improve this question
1
  • Hi and welcome to RE.SE. As far as I understand AFL, it mutates whatever input is provided and is able to generate input which triggers faulty behavior. The way it does that is by exploiting the fact that fork() keeps the full state of the program prior to the fork() and so it's relatively cheap to follow different execution paths simply by mutating the input as it goes. The author of AFL even provides a corpus of image files generated by AFL "from thin air" simply by fuzzing some image processing tool and generating/mutating input for it. – 0xC0000022L♦ Dec 9 '19 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.