performing-fuzzing-with-aflplusplus
Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.
Best use case
performing-fuzzing-with-aflplusplus is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.
Teams using performing-fuzzing-with-aflplusplus should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/performing-fuzzing-with-aflplusplus/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How performing-fuzzing-with-aflplusplus Compares
| Feature / Agent | performing-fuzzing-with-aflplusplus | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Performing Fuzzing with AFL++ ## Overview AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving, and persistent mode for high-throughput fuzzing. ## When to Use - When conducting security assessments that involve performing fuzzing with aflplusplus - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - AFL++ installed (`apt install afl++` or build from source) - Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only - Initial seed corpus of valid inputs for the target format - Linux system with /proc/sys/kernel/core_pattern configured ## Steps 1. Instrument the target binary with `afl-cc` or `afl-clang-fast` 2. Prepare seed corpus directory with minimal valid inputs 3. Minimize corpus with `afl-cmin` to remove redundant seeds 4. Run `afl-fuzz` with appropriate flags (-i input -o output) 5. Monitor fuzzing progress via afl-whatsup and UI stats 6. Triage crashes with `afl-tmin` minimization and CASR/GDB analysis 7. Report unique crashes with reproduction steps ## Expected Output ``` +++ Findings +++ unique crashes: 12 unique hangs: 3 last crash: 00:02:15 ago +++ Coverage +++ map density: 4.23% / 8.41% paths found: 1847 exec speed: 2145/sec ```