Hacker之路技能树（2）

Fuzzing 测试了tcpdump-4.6.2， 跑了一天1000+的crash，然而版本更新一次后啥都没有了。。

总结下：

初级————————————————————————————————

CC=afl-gcc ./configure
make

#To build tcpdump with afl instead of the default gcc compiler, I will set the CC environment variable to the afl-gcc binary I installed previously.

mkdir testcases findings
cp afl-1.83b/testcases/others/pcap/small_capture.pcap testcases/

#The archive of afl source code contains some example files you can use when fuzzing applications, and one of these files is a very small pcap file. This is what I will use as my single testcase to mutate and feed to tcpdump.

afl-fuzz -i testcases/ -o findings/ tcpdump-4.6.2/tcpdump -nr @@

#Fuzzing..

专家级————————————————————————————————

CC=afl-clang-fast ./configure
make

afl-fuzz -i testcases/ -o findings/ tcpdump-4.6.2/tcpdump -nr @@

#I can use a master/slave feature of afl that lets one afl-fuzz instance (the master) perform deterministic fuzzing while the slaves perform more traditional random fuzzing.

screen
afl-fuzz -i testcases/ -o syncdir/ -M fuzzer1 tcpdump-4.6.2/tcpdump -nr @@

#master

screen
afl-fuzz -i testcases/ -o syncdir/ -S fuzzer2 tcpdump-4.6.2/tcpdump -nr @@

#slave

afl-whatsup syncdir/

#check