mjhjmtu

I am trying to use afl-fuzz with openssl in Ubuntu. A normal usage of afl-fuzz would be:

afl-gcc test.c //-- this will produce a.out

mkdir testcases
echo "Test case here." > testcases/case1

afl-fuzz -i testcases -o findings ./a.out

Now for openssl it would be something like:

afl-gcc ./config
make //-- not sure of this :)
afl-fuzz -i test -o findings <exe_name>

where "test" is the folder with testcases for openssl

My question is what is the parameter for "exe_name" for openssl? And please correct me if i'm wrong with the rest of the code. Thank you

I'm exactly sure what you mean by "parameter for "exe_name" for openssl", but:

afl-fuzz -i test -o findings ~/path/to/binary/to/fuzz @@

will fuzz the binary at ~/path/to/binary/to/fuzz, substituting @@ with the path the mutated test case generated from the seed files in test.

You cannot use openssl binary just as it is. You need to write a separete program that will use openssl libraries and then fuzz its exe with afl-fuzz.

Whole process will go like that

Download openssl

1. ./config // If you disable something here like no-comp then you have to run`make depend`.
2. Replace gcc with afl-gcc in Makefile 
3. make && make install

This process will compile openssl with afl-gcc and you can look how instrumention will be added to object files. In end you will get libssl.a and libcrypto.a files in openssl directory.

After successful compilation of openssl, use it in a sample application say sample.c and then compile this file

4. afl-gcc sample.c -o sample libssl.a libcrypto.a -ldl

and then finally perform fuzzing
5. afl-fuzz -i testcases -o findings -m none -- ./sample

You can look at this and this to get some idea and even find sample files.