about summary refs log tree commit diff
path: root/docs/QuickStartGuide.txt
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2019-05-28 16:40:24 +0200
committervan Hauser <vh@thc.org>2019-05-28 16:40:24 +0200
commitf367728c4435670caf2e9cc5acad257e7766cc65 (patch)
tree5a4f587630b161f32a548f5c196032e2566741e2 /docs/QuickStartGuide.txt
parent1b3d018d35d9091bda28e38e066a99491f2415b5 (diff)
downloadafl++-f367728c4435670caf2e9cc5acad257e7766cc65.tar.gz
afl++ 2.52c initial commit
Diffstat (limited to 'docs/QuickStartGuide.txt')
-rw-r--r--docs/QuickStartGuide.txt49
1 files changed, 49 insertions, 0 deletions
diff --git a/docs/QuickStartGuide.txt b/docs/QuickStartGuide.txt
new file mode 100644
index 00000000..abe7032f
--- /dev/null
+++ b/docs/QuickStartGuide.txt
@@ -0,0 +1,49 @@
+=====================
+AFL quick start guide
+=====================
+
+You should read docs/README. It's pretty short. If you really can't, here's
+how to hit the ground running:
+
+1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips.
+
+2) Find or write a reasonably fast and simple program that takes data from
+   a file or stdin, processes it in a test-worthy way, then exits cleanly.
+   If testing a network service, modify it to run in the foreground and read
+   from stdin. When fuzzing a format that uses checksums, comment out the
+   checksum verification code, too.
+
+   The program must crash properly when a fault is encountered. Watch out for
+   custom SIGSEGV or SIGABRT handlers and background processes. For tips on
+   detecting non-crashing flaws, see section 11 in docs/README.
+
+3) Compile the program / library to be fuzzed using afl-gcc. A common way to
+   do this would be:
+
+   CC=/path/to/afl-gcc CXX=/path/to/afl-g++ ./configure --disable-shared
+   make clean all
+
+   If program build fails, ping <afl-users@googlegroups.com>.
+
+4) Get a small but valid input file that makes sense to the program. When
+   fuzzing verbose syntax (SQL, HTTP, etc), create a dictionary as described in
+   dictionaries/README.dictionaries, too.
+
+5) If the program reads from stdin, run 'afl-fuzz' like so:
+
+   ./afl-fuzz -i testcase_dir -o findings_dir -- \
+     /path/to/tested/program [...program's cmdline...]
+
+   If the program takes input from a file, you can put @@ in the program's
+   command line; AFL will put an auto-generated file name in there for you.
+
+6) Investigate anything shown in red in the fuzzer UI by promptly consulting
+   docs/status_screen.txt.
+
+That's it. Sit back, relax, and - time permitting - try to skim through the
+following files:
+
+  - docs/README               - A general introduction to AFL,
+  - docs/perf_tips.txt        - Simple tips on how to fuzz more quickly,
+  - docs/status_screen.txt    - An explanation of the tidbits shown in the UI,
+  - docs/parallel_fuzzing.txt - Advice on running AFL on multiple cores.