Maksim Shudrak - How To Improve Coverage-Guided Fuzzing & Find New 0days
Presents advanced AFL fuzzing strategies including custom mutators, target-aware input seeds, and sanitizer integration to maximize 0day discovery.
Summary
Advanced Coverage-Guided Fuzzing
Maksim Shudrak (Security Researcher) presents techniques to improve the effectiveness of AFL-based coverage-guided fuzzing for discovering previously unknown vulnerabilities.
Limitations of Vanilla AFL
Standard AFL fuzzing saturates coverage quickly on most targets, spending 95%+ of compute cycles generating inputs that exercise already-covered paths. Without targeted feedback, the fuzzer fails to reach deep vulnerability sites.
Custom Mutator Strategies
Shudrak presents grammar-aware mutators for structured input formats (XML, JSON, binary protocols) that generate semantically valid inputs reaching deeper code paths than random byte flipping. He demonstrates integrating libFuzzer's dictionary and structure-aware mutation into AFL campaigns.
Sanitizer Integration and Triage
Running fuzzing targets compiled with AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), and MemorySanitizer dramatically increases crash detection coverage. Shudrak presents automated crash deduplication and exploitability triage workflows using tools like ASAN crash analyzer and Exploitable.
Related talks
Main Stage·44 min
Jacob West
Jacob West details jacob West: How I Learned to Stop Fuzzing and Find More Bugs Fuzzing and other runtime testing techniques are great at finding certain kinds of bugs.
Main Stage·46 min
DeMott Enbody · Punch
DeMott Enbody and Punch explores revolutionizing grey box attack surface at DEF CON 15, examining fuzzing and practical defenses.
Black Hat·29 min
Presenters detail vulnerability discovery and exploitation in AFL's Blindspot and How to Resist AFL Fuzzing for Arbitrary ELF Binaries.