원클릭으로 Manus에서 모든 스킬 실행

performing-fuzzing-with-aflplusplus

스타680

포크120

업데이트2026년 6월 6일 16:41

Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

xalgord

xalgord/xalgorix

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Performing Fuzzing with AFL++

Overview

AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving, and persistent mode for high-throughput fuzzing.

When to Use

When conducting security assessments that involve performing fuzzing with aflplusplus
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Common Misconfigurations & Verification

A campaign that runs for hours with zero crashes is usually a setup problem, not a secure target.

No sanitizer, so bugs go silent: instrument with AFL_USE_ASAN=1 afl-cc (or afl-clang-fast). Without ASAN/UBSAN a heap overflow corrupts memory without crashing and AFL++ never flags it.
Empty or trivial seed corpus: starting -i with one tiny file leaves the fuzzer unable to reach parser logic. Provide diverse valid inputs, then prune with afl-cmin, and shrink each with afl-tmin.
No dictionary for structured formats: without -x dict/ (magic bytes, keywords, tokens) AFL++ wastes cycles guessing format headers. Supply a format dictionary.
Single-core run wastes the box: use -M main + several -S sec1 sec2 ... secondaries to fuzz in parallel and share finds via the sync dir.
Coverage stall ignored: map density flat and pending near zero for hours means saturation — add CMPLOG (-c), MOpt, or new seeds rather than letting it spin.

Verify the harness can actually find bugs: compile a build with a planted bug (e.g. an unchecked strcpy on input) and confirm AFL++ surfaces it in crashes/ within minutes and that afl-tmin + CASR/GDB reproduce it. If the planted bug is never found, fix instrumentation/seeds before trusting a clean run.

Prerequisites

AFL++ installed (apt install afl++ or build from source)
Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only
Initial seed corpus of valid inputs for the target format
Linux system with /proc/sys/kernel/core_pattern configured

Steps

Instrument the target binary with afl-cc or afl-clang-fast
Prepare seed corpus directory with minimal valid inputs
Minimize corpus with afl-cmin to remove redundant seeds
Run afl-fuzz with appropriate flags (-i input -o output)
Monitor fuzzing progress via afl-whatsup and UI stats
Triage crashes with afl-tmin minimization and CASR/GDB analysis
Report unique crashes with reproduction steps

Expected Output

+++ Findings +++
  unique crashes: 12
  unique hangs: 3
  last crash: 00:02:15 ago
+++ Coverage +++
  map density: 4.23% / 8.41%
  paths found: 1847
  exec speed: 2145/sec

이 저장소의 다른 Skills

같은 저장소

exploiting-subdomain-takeover-vulnerabilities

xalgord/xalgorix

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19680

detecting-ai-model-prompt-injection-attacks

xalgord/xalgorix

Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.

2026-06-06680

exploiting-ai-model-file-rce

xalgord/xalgorix

Testing machine-learning model files and model-loading services for remote code execution caused by insecure deserialization (pickle/PyTorch), unsafe config instantiation (Hydra), archive path traversal, and dangerous layer types during authorized penetration tests of AI/ML pipelines.

2026-06-06680

implementing-llm-guardrails-for-security

xalgord/xalgorix

Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII detection and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, enforcing topic boundaries) and model outputs (detecting hallucinations, filtering toxic content, validating JSON schema compliance). Activates for requests involving LLM output validation, AI content filtering, guardrail implementation, or LLM safety enforcement.

2026-06-06680

performing-ai-assisted-vulnerability-discovery

xalgord/xalgorix

Using LLMs to accelerate vulnerability research and pentest workflows — generating syntax-valid fuzzing seeds and evolving grammars, fine-tuned mutation dictionaries, parallel agent-based proof-of-vulnerability generation, and evidence-driven passive analysis of real HTTP traffic via the Burp MCP server. Covers concrete prompts, AFL++/ libFuzzer wiring, and Burp+Codex/Gemini/Ollama MCP setup.

2026-06-06680

testing-llm-prompt-injection-and-jailbreaks

xalgord/xalgorix

Testing LLM-backed applications, chatbots, and AI agents for direct and indirect prompt injection, jailbreaks, system-prompt leakage, and tool/agent abuse during authorized penetration tests, using structured payload families and reliable confirmation signals.

2026-06-06680

name	performing-fuzzing-with-aflplusplus
description	Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.
domain	cybersecurity
subdomain	application-security
tags	["fuzzing","aflplusplus","coverage-guided","crash-triage","binary-analysis","security-testing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.PS-01","PR.PS-04","ID.RA-01","PR.DS-10"]

Performing Fuzzing with AFL++

Overview

When to Use

When conducting security assessments that involve performing fuzzing with aflplusplus
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Common Misconfigurations & Verification

A campaign that runs for hours with zero crashes is usually a setup problem, not a secure target.

No sanitizer, so bugs go silent: instrument with AFL_USE_ASAN=1 afl-cc (or afl-clang-fast). Without ASAN/UBSAN a heap overflow corrupts memory without crashing and AFL++ never flags it.
Empty or trivial seed corpus: starting -i with one tiny file leaves the fuzzer unable to reach parser logic. Provide diverse valid inputs, then prune with afl-cmin, and shrink each with afl-tmin.
No dictionary for structured formats: without -x dict/ (magic bytes, keywords, tokens) AFL++ wastes cycles guessing format headers. Supply a format dictionary.
Single-core run wastes the box: use -M main + several -S sec1 sec2 ... secondaries to fuzz in parallel and share finds via the sync dir.
Coverage stall ignored: map density flat and pending near zero for hours means saturation — add CMPLOG (-c), MOpt, or new seeds rather than letting it spin.

Prerequisites

AFL++ installed (apt install afl++ or build from source)
Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only
Initial seed corpus of valid inputs for the target format
Linux system with /proc/sys/kernel/core_pattern configured

Steps

Instrument the target binary with afl-cc or afl-clang-fast
Prepare seed corpus directory with minimal valid inputs
Minimize corpus with afl-cmin to remove redundant seeds
Run afl-fuzz with appropriate flags (-i input -o output)
Monitor fuzzing progress via afl-whatsup and UI stats
Triage crashes with afl-tmin minimization and CASR/GDB analysis
Report unique crashes with reproduction steps

Expected Output

+++ Findings +++
  unique crashes: 12
  unique hangs: 3
  last crash: 00:02:15 ago
+++ Coverage +++
  map density: 4.23% / 8.41%
  paths found: 1847
  exec speed: 2145/sec