What is the recommended size for a dictionary?

For optimal performance, it is best to keep dictionaries focused, typically between 50 and 200 high-value entries to avoid diluting the mutation budget.

How do dictionaries improve testing?

They allow the fuzzer to bypass initial syntax or header checks by injecting valid tokens, enabling it to test the deeper, more complex logic of the application.

What is a fuzzing dictionary?

It is a collection of domain-specific tokens, such as keywords or magic bytes, used to guide a fuzzer toward interesting code paths that random data might not reach.

Can I generate a dictionary automatically?

Yes, this skill provides methods to extract tokens from header files, binary strings, and even documentation using command-line tools.

Which fuzzing tools are compatible with these dictionaries?

These dictionaries work with popular tools including libFuzzer, AFL++, cargo-fuzz for Rust, and can be adapted for others like go-fuzz.

Fuzzing Dictionary Guide

Name: Fuzzing Dictionary Guide
Author: fjor1025

byfjor1025

0•

セキュリティとテスト

Enhances software fuzzing effectiveness by providing domain-specific tokens and keywords to reach deeper code paths and edge cases.

The Fuzzing Dictionary skill provides a comprehensive framework for creating and implementing domain-specific token lists to guide fuzz testing tools like libFuzzer and AFL++. By incorporating known keywords, magic numbers, and protocol commands into the mutation process, this skill helps developers and security researchers bypass early validation checks and explore complex logic in parsers, protocol handlers, and file format processors that would otherwise be difficult to reach through random mutations alone.

主な機能

01Domain-specific patterns for HTTP, image formats, and configuration files

02Cross-fuzzer support for libFuzzer, AFL++, and cargo-fuzz

03Integration tips for specialized tools like Go-fuzz and Rust's cargo-fuzz

040 GitHub stars

05Automated dictionary generation from headers, binaries, and man pages

06Best practices to avoid common anti-patterns and performance bottlenecks

ユースケース

01Testing network protocol implementations for HTTP, DNS, or custom sockets

02Fuzzing complex file parsers for JSON, XML, or binary media formats

03Increasing code coverage in targets where random mutations fail to pass initial magic byte checks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework fuzzing-dictionary

For use in Claude.ai and ChatGPT

Download Skill