Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting targets via afl-cc/afl-clang-fast, minimizing corpora with afl-cmin and afl-tmin, running parallel campaigns with afl-fuzz, and triaging crashes with CASR or GDB scripts. Use for binary fuzzing, crash and memory-corruption discovery, coverage-guided testing, or running AFL++ fuzzing campaigns.
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-fuzzing-with-aflplusplus to fuzz the authorized [target binary/source] with [seed corpus] and deliver a report of unique crashes with reproduction steps; use a Linux environment with AFL++ and required instrumentation or QEMU mode.
Required inputs
[target binary/source]
[seed corpus]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-fuzzing-with-aflplusplusdescription: 'Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting targets via afl-cc/afl-clang-fast, minimizing corpora with afl-cmin and afl-tmin, running parallel campaigns with afl-fuzz, and triaging crashes with CASR or GDB scripts. Use for binary fuzzing, crash and memory-corruption discovery, coverage-guided testing, or running AFL++ fuzzing campaigns. 'domain: cybersecuritysubdomain: application-securitytags: - fuzzing- aflplusplus- coverage-guided- crash-triage- binary-analysis- security-testingversion: '1.0'author: mahipallicense: Apache-2.0nist_ai_rmf: - MEASURE-2.7- MAP-5.1- MANAGE-2.4atlas_techniques: - AML.T0070- AML.T0066- AML.T0082nist_csf: - PR.PS-01- PR.PS-04- ID.RA-01- PR.DS-10mitre_attack: - T1078- T1190- T1059- T1005
Performing Fuzzing with AFL++
Overview
AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided
fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode
for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes
advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving,
and persistent mode for high-throughput fuzzing.
When to Use
When conducting security assessments that involve performing fuzzing with aflplusplus
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
AFL++ installed (apt install afl++ or build from source)
Target binary source code (for compile-time instrumentation) or QEMU mode for binary-only
Initial seed corpus of valid inputs for the target format
Linux system with /proc/sys/kernel/core_pattern configured
Steps
Instrument the target binary with afl-cc or afl-clang-fast
Prepare seed corpus directory with minimal valid inputs
Minimize corpus with afl-cmin to remove redundant seeds
Run afl-fuzz with appropriate flags (-i input -o output)
Monitor fuzzing progress via afl-whatsup and UI stats
Triage crashes with afl-tmin minimization and CASR/GDB analysis