What it does
AFL++ is a fuzz-testing toolkit for exploring how a program responds to many generated inputs. A typical campaign instruments a target, starts from a seed corpus, mutates inputs while tracking coverage, and saves crashes or hangs for investigation. Its repository includes instrumentation modes, dictionaries, custom mutators, and guidance for managing campaigns. The reader must provide a target program or harness and representative inputs; AFL++ is not a black-box test service or a substitute for deciding whether a failure is exploitable.
Prepare a target and a seed corpus
AFL++'s getting-started material begins with a program that can be instrumented and a directory of input examples. Compile the target with a supported AFL++ instrumentation path, then start the campaign with an illustrative command such as afl-fuzz -i seeds_dir -o output_dir -- /path/to/tested/program. If the target reads from a file, the documentation shows using @@ as the placeholder for AFL++'s generated filename. These commands describe the documented workflow and were not executed here.
The fuzzer mutates the corpus and uses execution feedback to explore additional input paths. The project says crashes and hangs are written under the output directory; a maintainer then reproduces and triages each finding, and can add dictionaries or custom mutators when the input format benefits from them. Read the in-depth guide before treating a campaign as complete, since target instrumentation and corpus quality shape what it can discover.
Read the license for the files you use
AFL++ is primarily licensed under AGPL-3.0-or-later, while some files are Apache-2.0; the repository says each file's SPDX identifier governs. It also describes an alternative commercial license obtained by donating to a good cause. Teams should check those terms before integrating or distributing the fuzzer. No target was built or fuzzed for this record.
Strengths
- Coverage-guided mutation can explore varied inputs and record crashes or hangs for later reproduction.
- The project documents instrumentation, seed-corpus preparation, dictionaries, custom mutators, and campaign management.
- AFL++ can be run locally or in container-based build workflows, with output available for triage.
Watch out for
- A useful campaign requires an instrumentable target or harness, representative seeds, and follow-up work to reproduce and triage findings.
- The main fuzzer is AGPL-3.0-or-later, with file-level license variation; organizations must review the exact files and applicable terms.
Best for
- Fuzzing parsers, file formats, and other programs that accept structured or arbitrary input
- Native-code teams with a target they can instrument and a starter corpus to mutate
- Security and reliability engineers who can investigate crashes and hangs found by a fuzzing campaign
Sources
- AFL++ repository README (Oct 26, 2026)
- AFL++ documentation overview (Oct 26, 2026)
- AFL++ Fuzzing in Depth (Oct 26, 2026)
- AFL++ Licensing (Oct 26, 2026)