{"id":"offensive-fuzzing","name":"offensive-fuzzing","summary":"ターゲット識別、ファザー選択(AFL++、libFuzzer、Honggfuzz、Boofuzz、syzkaller)、ハーネス作成、コーパスキュレーション、突然変異戦略、カバレッジ測定、クラッシュトリアージをカバーする実践的な攻撃ファジング手法。","body":"# Offensive Fuzzing\n\n## Fuzzer Types\n\n| Type | Coverage | Speed | Tools |\n|------|----------|-------|-------|\n| BlackBox | Poor | Fast | Peach, Boofuzz |\n| GreyBox | Good | Fast | AFL++, Honggfuzz, libFuzzer, WinAFL |\n| Snapshot | Good | Fastest | Nyx, wtf, Snapchange |\n| WhiteBox | Best | Slow | KLEE, QSYM, SymSan |\n| Ensemble | Best | Fast | AFL++ + Honggfuzz + libFuzzer |\n\n**GreyBox sub-variants:** Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).\n\n## Core Workflow\n\n```\nResearch target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report\n```\n\n### 1. Research Target\n\n- Map all input surfaces (files, network, IPC, syscalls, IOCTL)\n- Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points\n- For kernel modules: look beyond `copy_from_user` — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks\n\n### 2. Instrument and Build\n\n```bash\n# AFL++ (preferred for GreyBox)\nCC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j\n\n# libFuzzer + ASan/UBSan (C/C++)\ncmake -DCMAKE_CXX_FLAGS=\"-fsanitize=fuzzer,address,undefined -O1 -g\" ..\n\n# CmpLog build for hard compares\nAFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all\n```\n\n**Windows (MSVC):** `Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)`\n\n### 3. Write Harness\n\n**libFuzzer (C++):**\n```cpp\n#include <cstdint>\n#include <cstddef>\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {\n    parse_or_process(data, size);\n    return 0;\n}\n```\n\n**Honggfuzz HF_ITER (persistent mode — preferred for large targets):**\n```cpp\n#include \"honggfuzz.h\"\nint main(int argc, char** argv) {\n    initialize_target(); // runs once\n    for (;;) {\n        size_t len; uint8_t *buf;\n        HF_ITER(&buf, &len);\n        FILE* s = fmemopen(buf, len, \"r\");\n        target_function(s);\n        fclose(s);\n        reset_target_state();\n    }\n}\n```\n\n**AFL++ persistent mode (`__AFL_LOOP`):**\n```cpp\nwhile (__AFL_LOOP(10000)) {\n    // re-read input and process\n}\n```\n\n**macOS IPC (Mach message fuzzing):**\n```c\nvoid *lib_handle = dlopen(\"libexample.dylib\", RTLD_LAZY);\npFunction = dlsym(lib_handle, \"DesiredFunction\");\n```\n\n### 4. Build Seed Corpus\n\n- Pull from target's test suite, bug reports, and real-world samples\n- Web-crawl (Common Crawl) for file formats; filter by MIME type\n- Minimize: `afl-cmin -i raw_corpus -o seeds -- ./target @@`\n- Trim inputs: `afl-tmin -i crash -o crash.min -- ./target @@`\n\n### 5. Launch Fuzzing\n\n**AFL++ parallel (primary + secondary with cmplog):**\n```bash\nafl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@\nafl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@\n```\n\n**libFuzzer:**\n```bash\n./target_libfuzzer corpus/ -max_total_time=3600 -workers=4\n```\n\n**Binary-only (QEMU):**\n```bash\nafl-fuzz -Q -i seeds -o findings -- target.exe @@\n```\n\n**Snapshot (AFL++ Nyx):**\n```bash\nNYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@\n```\n\n**Ensemble (AFL++ + Honggfuzz sharing corpus):**\n```bash\n# Terminal 1\nafl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@\n# Terminal 2\n../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \\\n  --linux_perf_ipt_block -t 10 -- ./target ___FILE___\n```\n\n### 6. Monitor and Unstick\n\nIf progress stalls:\n- Enable CmpLog: `-c 0` on AFL++ secondaries\n- Add dictionary: `-x dict.txt` or `AFL_TOKEN_FILE`\n- Switch to directed fuzzing (AFLGo) targeting specific BBs/functions\n- Use concolic assistance (QSYM, Driller) on hard branches\n- Snapshot the target to increase exec/s\n- `AFL_MAP_SIZE=1048576`, `-L 0` for MOpt scheduler\n\n### 7. Triage Crashes\n\n```bash\n# 1. Minimize\nafl-tmin -i crash -o crash.min -- ./target @@\n# 2. Symbolize\nASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log\n# 3. Hash + bucket\n./cov-tool --bbids ./target crash.min > cov.hash\n./bucket.py --key \"$(cat cov.hash)\" --log asan.log --out triage/\n```\n\n**Sanitizer env quick reference:**\n```\nASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1\nUBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1\nTSAN_OPTIONS=halt_on_error=1:history_size=7\nMSAN_OPTIONS=poison_in_dtor=1:track_origins=2\n```\n\n## Oracle Selection\n\n| Bug Class | Oracle |\n|-----------|--------|\n| Memory safety | ASan, HWASan (AArch64, lower overhead) |\n| Uninitialized reads | MSan |\n| Concurrency | TSan |\n| Undefined behavior | UBSan |\n| Type safety | TypeSan |\n| Heap hardening | Scudo Hardened Allocator |\n| Logic bugs | Differential / idempotency oracles |\n| Kernel memory | KASAN, KMSAN, KCSAN |\n| Kernel UB | KUBSan (`CONFIG_UBSAN_TRAP=y`) |\n| CFI | KCFI (`-fsanitize=kcfi`, Clang 18) |\n| Binary-only | QASAN (QEMU+ASan), DynamoRIO |\n\n**Property oracle patterns:**\n- Idempotency: `f(x) == f(f(x))`\n- Differential: compare two impls, bucket on output mismatch\n- Invariants: monotonic lengths, checksum equality, schema validation post-parse\n\n## Specialized Targets\n\n### Kernel (Linux) — syzkaller\n\n```json\n{\n  \"target\": \"linux/arm64\",\n  \"http\": \":56700\",\n  \"workdir\": \"/path/to/workdir\",\n  \"kernel_obj\": \"/path/to/kernel\",\n  \"image\": \"/path/to/rootfs.ext3\",\n  \"sshkey\": \"/path/to/id_rsa\",\n  \"procs\": 8,\n  \"enable_syscalls\": [\"openat$module_name\", \"ioctl$IOCTL_CMD\", \"mmap\"],\n  \"type\": \"qemu\",\n  \"vm\": { \"count\": 4, \"cpu\": 2, \"mem\": 2048 }\n}\n```\n\n- Limit `enable_syscalls` to deepen coverage on specific subsystems\n- Use `syz-extract` to pull constants for custom modules\n- Enable `CONFIG_KASAN=y`, `CONFIG_KCFI=y`, `CONFIG_DEBUG_INFO_BTF=y`\n- Use `kcov` filters and `syz_cover_filter` to direct coverage\n- Network fuzzing: inject via `TUN/TAP` + pseudo-syscalls (`syz_emit_ethernet`)\n- Crash decode: `./scripts/decode_stacktrace.sh vmlinux ... < dmesg.log`\n\n**syzkaller repro:**\n```bash\nsyz-execprog -repeat=0 -procs=1 -cover=0 -debug target.repro\n```\n\n### EDR / Windows Scanning Engines\n\n**WTF snapshot harness skeleton (mpengine.dll / mini-filter):**\n```cpp\ng_Backend->SetBreakpoint(\"nt!KeBugCheck2\", [](Backend_t *Backend) {\n    const uint64_t BCode = Backend->GetArg(0);\n    Backend->Stop(Crash_t(fmt::format(\"crash-{:#x}\", BCode)));\n});\n```\n\n**FilterConnectionPort fuzzing:**\n```cpp\nHANDLE hPort;\nFilterConnectCommunicationPort(L\"\\\\PortName\", 0, NULL, 0, NULL, &hPort);\nFilterSendMessage(hPort, fuzzData, sizeof(fuzzData), NULL, 0, &bytesReturned);\n```\n\n**IOCTL fuzzing pattern:**\n```cpp\nHANDLE hDev = CreateFile(L\"\\\\\\\\.\\\\DeviceName\", GENERIC_READ|GENERIC_WRITE, ...);\nDeviceIoControl(hDev, ioctlCode, inputBuf, inputLen, outBuf, outLen, &ret, NULL);\n```\n\n- Take snapshots after initialization, right before parse/dispatch loop\n- Use IDA Lighthouse for coverage visualization\n- Monitor: `DRIVER_VERIFIER_DETECTED_VIOLATION (0xc4)`, `IRQL_NOT_LESS_OR_EQUAL (0xa)`\n- WinDbg: `.symfix; !analyze -v; k; !heap -p -a @rax`\n\n**Cross-platform mpengine.dll on Linux (loadlibrary + HF_ITER + Intel PT):**\n```cpp\n// Bypass Lua VM to avoid stability issues\ninsert_function_redirect((void*)luaV_execute_address, my_lua_exec, HOOK_REPLACE_FUNCTION);\nfor (;;) {\n    HF_ITER(&buf, &len);\n    ScanDescriptor.UserPtr = fmemopen(buf, len, \"r\");\n    __rsignal(&KernelHandle, RSIG_SCAN_STREAMBUFFER, &ScanParams, sizeof ScanParams);\n}\n```\n\n### Rust\n\n```bash\n# Full Rust fuzzing pipeline\ncargo test                                         # 1. property tests\ncargo +nightly miri test                           # 2. UB via interpreter\ncargo +nightly careful test                        # 3. runtime bounds checks\ncargo fuzz run fuzz_target_1 -- -max_total_time=3600  # 4. libFuzzer crashes\nRUSTFLAGS=\"--cfg loom\" cargo test --release        # 5. concurrency (if needed)\ncargo fuzz coverage fuzz_target_1                  # 6. coverage report\n```\n\nFocus unsafe blocks on: `Vec::from_raw_parts`, unchecked indexing, `transmute` size mismatches, pointer arithmetic, FFI integer truncation.\n\n### Embedded / Binary-Only\n\n- **LibAFL**: Modular Rust framework; Unicorn engine, snapshot module, LBRFeedback (zero-instrumentation on Intel), SAND decoupled sanitization\n- **Retrowrite / QASAN**: Binary rewriting for coverage + ASan without source\n- **Nautilus**: Grammar-based fuzzing for structured formats\n\n### Language Ecosystems\n\n- **Go 1.18+**: `go test -fuzz=Fuzz -run=^$ ./...`\n- **Python**: [Atheris](https://github.com/google/atheris) (CPython native extension fuzzing)\n- **Rust**: `cargo-fuzz` or `honggfuzz-rs`\n- **JS engines**: Fuzzilli with extended instrumentation (`__builtin_return_address(0)` for PC tracking)\n- **Wasm runtimes**: `wasmtime-fuzz`, `wafl` for differential fuzzing across V8/Wasmer/Wasmtime\n- **Smart contracts**: Echidna, Foundry-fuzz (Solidity); Move-Fuzz (Aptos/Sui)\n\n## CI/CD Integration\n\n```yaml\n- name: Build with afl-clang-fast\n  run: CC=afl-clang-fast make -j\n- name: Fuzz (smoke, 15 min)\n  run: timeout 15m afl-fuzz -i seeds -o findings -- ./target @@ || true\n- name: Upload crashes\n  if: always()\n  uses: actions/upload-artifact@v4\n  with:\n    path: findings/**/crashes/*\n```\n\nUse **ClusterFuzzLite** for persistent continuous fuzzing; cache corpora between runs.\n\n## Crash Analysis Quick Reference\n\n**Linux:**\n```bash\nulimit -c unlimited && sysctl -w kernel.core_pattern=core.%e.%p\ngdb -q ./target core.* -ex 'bt' -ex 'info reg' -ex q\naddr2line -e ./target 0xDEADBEEF\n```\n\n**Windows:**\n```powershell\n# Enable local dumps\nNew-Item 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps' -Force\n# PageHeap\ngflags /p /enable target.exe /full\n```\n\n**Kernel KASAN/KMSAN:**\n```bash\ndmesg -T | egrep -i 'kasan|kmsan' -A 60\n./scripts/decode_stacktrace.sh vmlinux /lib/modules/$(uname -r)/build < dmesg.log\n```\n\n**Reproducibility:** pin CPU governor, disable ASLR only where safe, fix RNG seeds, save input sequences in persistent mode, record binary hashes and sanitizer options with every crash.\n\n## Tool Index\n\n| Tool | Use Case |\n|------|----------|\n| [AFL++](https://github.com/AFLplusplus/AFLplusplus) | General GreyBox, CmpLog, MOpt, Nyx |\n| [Honggfuzz](https://github.com/google/honggfuzz) | Intel PT, crash detection, HF_ITER |\n| [libFuzzer](https://llvm.org/docs/LibFuzzer.html) | In-process, source available |\n| [syzkaller](https://github.com/google/syzkaller) | Linux/Windows kernel syscall fuzzing |\n| [wtf](https://github.com/0vercl0k/wtf) | Snapshot fuzzing, Windows targets |\n| [Nyx](https://github.com/nyx-fuzz/Nyx) | AFL++ snapshot mode (Intel PT) |\n| [Snapchange](https://github.com/awslabs/snapchange) | AWS snapshot fuzzing |\n| [LibAFL](https://github.com/AFLplusplus/LibAFL) | Custom Rust fuzzing framework |\n| [AFLGo](https://github.com/aflgo/aflgo) | Directed fuzzing to target BB/function |\n| [kAFL](https://github.com/IntelLabs/kAFL) | Kernel + OS fuzzing |\n| [Jackalope](https://github.com/googleprojectzero/Jackalope) | Binary coverage-guided (Windows/macOS) |\n| [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) | Rust libFuzzer integration |\n| [Atheris](https://github.com/google/atheris) | Python fuzzing |\n| [Nautilus](https://github.com/nautilus-fuzz/nautilus) | Grammar-based fuzzing |\n| [AFLTriage](https://github.com/quic/AFLTriage) | Automated crash triage |\n| [afl-cov](https://github.com/mrash/afl-cov) | Coverage analysis for AFL++ |\n| [ClusterFuzz](https://github.com/google/clusterfuzz) | Distributed fuzzing infrastructure |","author":"@SnailSploit","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/SnailSploit/Claude-Red/tree/main/Skills/fuzzing/offensive-fuzzing","license":"MIT","category":"writing","lang":"en","tokens":3448,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["llvm.org"]}}