is a project that brings integration of AFL++ (American Fuzzy Lop) with Lua programming language. It allows to perform fuzzing testing of programs written in Lua.
- Download and setup Lua interpreter and LuaRocks.
- Install AFL++ package:
sudo apt install -y afl++(on Debian). - Install module using LuaRocks:
luarocks --local install afl-lua. - Update a
PATH:export PATH=$PATH:$(luarocks path --lr-bin).
Create a file with Lua program that reads a string from a STDIN:
$ cat << EOF > example.lua
function fuzz()
local buf = io.read("*a")
local b = {}
buf:gsub(".", function(c) table.insert(b, c) end)
if b[1] == 'l' then
if b[2] == 'u' then
if b[3] == 'a' then
assert(nil)
end
end
end
end
fuzz()
EOFMake sure Lua script has failed when string "lua" is passed to STDIN:
$ echo "lua" | lua example.lua
lua: example.lua:8: assertion failed!
stack traceback:
[C]: in function 'assert'
example.lua:8: in function 'fuzz'
example.lua:14: in main chunk
[C]: in ?Execute afl-lua against a Lua script:
$ mkdir -p {in,out}
$ echo -n "\0" > in/corpus
$ __AFL_SHM_ID=$RANDOM afl-fuzz -D -i in/ -o out/ afl-lua example.luaAfter some time, the fuzzer will find a test case with which the program will crash:
$ cat out/default/crashes/id\:000000\,sig\:06\,src\:000008\,time\:197253\,execs\:113636\,op\:havoc\,rep\:4
luaiiiii^ii- Copyright © 2022-2023 Sergey Bronnikov
- Copyright © 2020 Steven Johnstone
Distributed under the MIT License.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent