{"id":4016,"date":"2015-11-21T00:39:50","date_gmt":"2015-11-20T16:39:50","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4016"},"modified":"2015-11-21T00:43:50","modified_gmt":"2015-11-20T16:43:50","slug":"american-fuzzy-lop-security-oriented-fuzzing-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/11\/american-fuzzy-lop-security-oriented-fuzzing-tool\/","title":{"rendered":"american fuzzy lop – Security Oriented Fuzzing Tool"},"content":{"rendered":"

American fuzzy lop is a security-oriented fuzzing tool<\/a> that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labour or resource-intensive testing regimes down the road.<\/p>\n

\"american<\/p>\n

Compared to other instrumented fuzzers, afl-fuzz is designed to be practical: it has modest performance overhead, uses a variety of highly effective fuzzing strategies and effort minimization tricks, requires essentially no configuration, and seamlessly handles complex, real-world use cases – say, common image parsing or file compression libraries.<\/p>\n

So, What’s Good?<\/h3>\n

In a hurry? There are several fairly decent reasons to give afl-fuzz a try:<\/p>\n