afl-fuzz(1)

afl-fuzz1

Code fuzzer for american fuzzy lop (afl)

Usage

afl-fuzz -i <testcase_dir> -o <findings_dir> [options] -- /path/to/fuzzed/app [params]

Overview

This program takes an binary and attempts a variety of fuzzing strategies, paying close attention on how they affect the execution path.

To operate correctly, the fuzzer requires one or more starting files containing the typical input normally expected by the targeted application.

For instrumentated fuzzing, the binary must be compiled using either one of the shipped gcc or clang wrappers. Put -n to fuzz w/o instrumentation in dumb mode.

Please regard that a full fuzzing process takes a lot of time. For exhaustive information on afl, see the documentation in /usr/share/doc/afl-doc.

Options

Run afl-fuzz without any arguments to see a complete list of options.

Releases

Unchanged in 2 releases since Debian 9 (Stretch).

  1. 9–10

Authors

American Fuzzy Lop is written by Michal Zalewski <[email protected]>. Forkserver design by Jann Horn <[email protected]>. This manpage was written by Daniel Stender <[email protected]>.

From afl 2.52b-5 in Debian 10 (Buster). Parsed by carta from the page's man source.