American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labor- or resource-intensive testing regimes down the road.
Compared to other instrumented fuzzers, afl-fuzz is designed to be practical: it has modest performance overhead, uses a variety of highly effective fuzzing strategies and effort minimization tricks, requires essentially no configuration, and seamlessly handles complex, real-world use cases - say, common image parsing or file compression libraries.
In a hurry? There are several fairly decent reasons to give afl-fuzz a try:
**It's chainable to other tools.** The fuzzer generates superior, compact test corpora that can serve as a seed for more specialized, slower, or labor-intensive processes and testing frameworks. It is also capable on on-the-fly corpus synchronization with any other software.
**It sports a hip, retro-style UI.** Just scroll back to the top of the page. Enough said.
Want to try it out? Check out the documentation or grab the source code right away; there is also a single-page quick start guide. Still unconvinced? Have a look at the technical whitepaper to see what makes AFL tick.
Yeah, it finds bugs. I am focusing chiefly on development and have not been running the fuzzer at a scale, but here are some of the notable vulnerabilities and other uniquely interesting bugs that are attributable to AFL (in large part thanks to the work done by other users):
On top of this, the fuzzer helped make countless non-security improvements to core tools (v8, sed, awk, make, m4, yacc, PHP, ImageMagick, freedesktop.org, patch, libtasn1, libvorbis, zsh, lua, ninja, ruby, busybox, gcrypt, vim, Tor, poppler, libopus, BSD sh, gcc, qemu, w3m, zsh, dropbear, libtorrent, git, rust, gravity, e2fsprogs, etc); found security issues in all sorts of less-widespread software (e.g., parrot, lodepng, json-glib, cabextract, libmspack, qprint, gpsbabel, dmg2img, antiword, arj, unrar, unace, zoo, rzip, lrzip, libiso*, libtta, duktape, splint, zpaq, assimp, cppcheck, fasm, catdoc, pngcrush, cmark, p7zip, libjbig2, aaphoto, t1utils, apngopt, sqlparser, mdp, libtinyxml, freexl, bgpparser, testdisk, photorec, btcd, gumbo, chaiscript, teseq, colcrt, pttbbs, capstone, dex2oat, pillow, elftoolchain, aribas, universal-ctags, uriparser, jq, lha, xdelta, gnuplot, libwpd, teseq, cimg, libiberty, policycoreutils, libsemanage, renoise, metapixel, openclone, mp3splt, podofo, glslang, UEFITool, libcbor, lldpd, pngquant, muparserx, mochilo, pyhocon, sysdig, Overpass-API, fish-shell, gumbo-parser, mapbox-gl-native, rapidjson, libjson, FLIF, MultiMarkdown, astyle, pax-utils, zziplib, PyPDF, spiffing, apk, pgpdump, icoutils, msitools, dosfstools, schoco, MojoShader, and so on); and is likely responsible for quite a few other things that weren't publicly attributed to the tool.
Here's a collection of useful links related to afl-fuzz: