#RomHack2021 - Antonio Morales - Fuzzing Apache HTTP Server for fun (and CVEs)

## Fuzzing Apache httpd at Scale

GitHub Security Lab researcher Antonio Morales details fuzzing the Apache HTTP Server at RomHack, aiming to improve open-source security through automated testing. His work targets C/C++ codebases using AFL++ and custom tooling, with Apache httpd as a flagship case study yielding multiple CVEs.

## Architecture and Attack Surface

Apache's lifecycle spans startup (config parsing, library loading), operation (privilege drop from root via setuid, request processing), and cleanup. The Apache Portable Runtime provides cross-platform memory pools, I/O, threading, and shared memory—each module representing fuzzing entry points.

## Incremental Module Coverage

Morales describes enabling modules progressively in httpd.conf, stabilizing fuzzing harnesses before expanding scope until all modules run reliably. This incremental approach prevents crashes from misconfiguration from masking deeper bugs in rarely loaded extensions.

## Custom HTTP Mutators

Default AFL bit-flip mutators poorly suit structured HTTP traffic. Morales built protocol-aware custom mutators generating valid request grammars, dramatically improving crash discovery rates. Code is published on GitHub for researchers extending coverage to other network-facing parsers.