About

American fuzzy lop is a program for fuzzing inputs. It is very sophisticated and can be instrumented with a binary to do very targeted fuzzing.

Installing

Get the latest version, and run make to make it:

$ wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz 
$ tar -xvf afl-latest.tgz cd afl-latest.tgz
$ cd afl-*
$ make 
$ make install

Success!

root@morpheus:~/codes/afl-2.10b# which afl-fuzz
/usr/local/bin/afl-fuzz

Programs that can be fuzzed are those that take input files, usually binary files or unusual formats. (Think mp3, multimedia, images, etc.)

We'll be fuzzing John the Ripper to understand how AFL works.

We want to download and compile John so that it will be instrumented.

Start with dependencies - OpenSSL development libs:

# apt-get install --fix-missing libssl-dev

# git clone git@github.com:magnumripper/JohnTheRipper.git
# cd JohnTheRipper/src
# ./configure --help