/fuzz

RAPTOR binary fuzzing with AFL++

Overview

The /fuzz command performs coverage-guided fuzzing on binary executables using AFL++. It’s an alias for /raptor-fuzz and automatically analyzes crashes to generate exploits.

Syntax

python3 raptor.py fuzz --binary <path> [options]

Parameters

binary · string · required

Absolute path to the binary executable to fuzz

duration · integer

Fuzzing duration in seconds (default: 6600 = 110 minutes)

corpus · string

Path to seed corpus directory for initial test cases

max-crashes · integer

Maximum number of crashes to collect before stopping

What It Does

1. Configures AFL++ fuzzing environment
2. Runs coverage-guided fuzzing on the target binary
3. Detects crashes and hangs
4. Automatically analyzes crashes with ASAN
5. Generates exploit PoCs for discovered vulnerabilities
6. Produces crash analysis reports

Examples

Basic Fuzzing (110 minutes)

python3 raptor.py fuzz --binary /path/to/binary --duration 6600

Runs standard fuzzing session with default duration.

Quick Fuzz Test (10 minutes)

python3 raptor.py fuzz --binary /path/to/binary --duration 600 --max-crashes 5

Quick fuzzing run that stops after finding 5 crashes.

With Custom Seed Corpus

python3 raptor.py fuzz --binary /path/to/binary --corpus /path/to/seeds --duration 3600

Starts fuzzing with pre-existing test cases for better coverage.

Prerequisites

Required Tools

• AFL++: Coverage-guided fuzzer
• ASAN: AddressSanitizer for crash detection
• GCC/Clang: Compiler with sanitizer support

Optimal Binary Compilation

# Compile with AFL instrumentation and ASAN
afl-clang-fast -fsanitize=address -g -o binary source.c

macOS Configuration

If fuzzing fails with shmget() failed error:

sudo afl-system-config

Output Structure

out/fuzz_<binary>_<timestamp>/
├── afl_output/
│   └── main/
│       ├── crashes/       # Crash test cases
│       ├── hangs/         # Hang test cases
│       └── queue/         # Corpus queue
├── crash-analysis/        # Crash reports
├── exploits/             # Generated PoCs
└── fuzzing-report.md     # Summary report

Vulnerability Types Detected

• Buffer overflows
• Heap corruption
• Use-after-free
• Stack overflow
• Integer overflow
• Format string bugs
• Null pointer dereference

Use Cases

• Binary security auditing
• Crash discovery and analysis
• Exploit development
• Regression testing
• Memory corruption detection

Performance Tips

• Compile with AFL instrumentation for better coverage
• Use ASAN for precise crash detection
• Provide quality seed corpus for faster results
• Run for at least 1 hour for meaningful results
• Use multiple CPU cores with parallel fuzzing

Related Commands

/crash-analysis

Deep root-cause analysis of crashes

/exploit

Generate exploit PoCs from vulnerabilities

/validate

Validate exploitability of findings

Notes

• Fuzzing can take hours to days for thorough coverage
• RAPTOR automatically analyzes crashes and generates exploits
• Binary should ideally be compiled with instrumentation
• For educational and authorized testing only