Integrate AFL++ with Vulnetix. Fuzz C/C++ binaries to discover crashes, then convert crash artifacts to JSON findings for upload.
Install & scan
$ # Docker (recommended: all tooling pre-installed) docker pull aflplusplus/aflplusplus docker run -ti -v $(pwd):/src aflplusplus/aflplusplus $ # Step 1: Compile target with AFL++ instrumentation afl-clang-fast -o target_fuzz fuzz_target.c # Step 2: Create seed corpus mkdir seeds && echo "hello" > seeds/seed1.txt # Step 3: Run fuzzer AFL_FAST_CAL=1 afl-fuzz -i seeds -o out -- ./target_fuzz @@ # Crashes saved to: out/default/crashes/
Run AFL++ in CI
Scan on every push and upload the report as a workflow artifact:
- name: Build fuzz target
run: |
docker run --rm -v $(pwd):/src aflplusplus/aflplusplus bash -c "cd /src && AFL_USE_ASAN=1 afl-clang-fast -o target_fuzz fuzz_target.c"
- name: Run fuzzer (60 seconds)
run: |
docker run --rm -v $(pwd):/src aflplusplus/aflplusplus bash -c "timeout 60 afl-fuzz -i /src/seeds -o /src/out -- /src/target_fuzz @@ || true"
- name: Check for crashes
run: ls out/default/crashes/ | grep "^id:" | wc -l
How Vulnetix compares: better together
Vulnetix does not replace AFL++. Keep running it. Vulnetix sits on top of AFL++ (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
| Capability | Vulnetix | AFL++ |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✓ Coverage-guided C/C++ and binary-only fuzzer; core purpose of the tool. |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What AFL++ does well
- Best-in-class coverage-guided fuzzing for C/C++ with a rich mutator set (MOpt, custom/grammar mutators, AFLfast power schedules) that finds deep memory-corruption bugs static analysis cannot reach
- Binary-only fuzzing without source via QEMU, Unicorn, QBDI and FRIDA modes, including CompareCoverage and persistent mode for 3-8x speedups
- Integrates directly with sanitizers (ASAN/MSAN/UBSAN, plus QASan for ASAN-under-QEMU) to turn subtle undefined behavior into reproducible crashes
- Mature tooling ecosystem: corpus/testcase minimization (afl-cmin, afl-tmin) and multiple instrumentation backends (LLVM, GCC plugin, afl-as)
Where Vulnetix adds to it: Vulnetix does not run fuzzing itself; it ingests and orchestrates AFL++ crash output alongside SAST/SCA/container/secrets results, deduplicating findings into one prioritised queue with EPSS/KEV/LEV exploit-intel, reachability, versioned VEX and Safe Harbour autofix. Better together: AFL++ discovers the runtime crashes, Vulnetix triages and tracks them.
No migration, no rip-and-replace. AFL++ keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise AFL++ results in Vulnetix
Upload AFL++ JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.