lylemi / aflnw

AFLNW: network wrapper for AFL

Hi there 👋

I'm Lyle

• Currently working on Web Security / Fuzz / IoT
• Twitter: https://twitter.com/LyleCrash
• Blog: https://blog.lyle.ac.cn/

aflnw's Issues

How to collect crashes?

Hello, thank you for sharing this project. I have successfully built and deployed your software, but I don't quite understand how to collect crashes? When running with AFL, the crashes never get counted or logged, despite being able to see the crash and stack trace appear in the terminal of the software we're fuzzing.

For example, using the command line from your README:
/afl-fuzz -i ./input -o ./output -- ./aflnw -a 127.0.0.1 -p 8888 -- /opt/fuzz/nginx/objs/nginx

This doesn't actually start nginx, we have to start nginx in another terminal. Once we do that, we can start seeing some network requests being made towards nginx, and when we finally get nginx to crash, AFL keeps on running and doesn't log the crash or save the reproducing testcase. Can you advise on how to capture the crashes? Thank you.

编译时报错error: linker command failed with exit code 1

采集种子输入的时候，最后的格式是什么样子的？

wireshark抓包并没有抓到什么数据

网络服务挂掉之后，afl没有检测到崩溃，依然继续执行fuzz

您这里的代码很明朗，如果无法建立tcp连接，则程序crash。

    int ret = connect(
                  server_fd, (const struct sockaddr *)&server_listen_addr,
                  sizeof(struct sockaddr)
              );
    printf("send ret %d\n", ret);
    if (ret < 0)
    {
        crash();
    }

但是我在测试过程中，发现只有系统崩溃时才会停止，如果服务挂掉（端口挂），fuzz依然继续.

最新版本的代码如何使用？

你好，我注意到aflnw的代码有了更新，参数也更多了，请问有相关的文档说明如何使用吗？谢谢！