aeondave/boofuzz
offensive-tools/fuzzing/boofuzz/SKILL.md
Auth/lab ref: Python network protocol fuzzing framework (Sulley successor). For stateful TCP/UDP protocol fuzzing, request-graph modeling, monitor-driven crash detection, and reproducible protocol campaign workflows.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill boofuzzInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 3:49 AM116.3s1 file scanned
SKILL.md
- name:
- boofuzz
- description:
- Auth/lab ref: Python network protocol fuzzing framework (Sulley successor). For stateful TCP/UDP protocol fuzzing, request-graph modeling, monitor-driven crash detection, and reproducible protocol campaign workflows.
- license:
- GPL-2.0
- compatibility:
- Python 3 on Linux/Windows/macOS.
- author:
- GitHub Copilot
- version:
- 1.1
boofuzz
Protocol fuzzer framework with request modeling, session graphs, monitors, and structured logging.
Quick Start
pip install boofuzz
from boofuzz import Session, Target, TCPSocketConnection, s_initialize, s_string, s_get
s_initialize("req")
s_string("HELLO", fuzzable=True)
session = Session(target=Target(connection=TCPSocketConnection("127.0.0.1", 9999)))
session.connect(s_get("req"))
session.fuzz()
Operator Flow (Recommended)
- Define protocol requests as
Request+Block+ primitives. - Build realistic session graph via
session.connect(...). - Add monitors (process/network/callback) before scaling testcases.
- Enable logs and reproduce individual failing testcases from run DB.
- Iterate on protocol model quality (field sizes, delimiters, checksums, dependencies).
Best Use Cases
- Custom/legacy network protocols.
- Stateful handshake + multi-step message flows.
- Harnesses requiring explicit restart/monitor logic.
Practical Tricks
- Use
post_test_case_callbacksfor protocol-aware checks instead of only crash/no-crash signals. - Use
ProtocolSessionReferencewhen later messages need dynamic data extracted from prior responses. - Keep a strict separation between:
- transport connection behavior,
- protocol message modeling,
- health/monitoring logic.
- Prefer deterministic target reset routines in monitor hooks.
Common Pitfalls
- Blind mutation of raw bytes without block/field modeling wastes boofuzz strengths.
- No monitor/restart chain -> flaky crash attribution.
- Overly broad callback side effects -> non-deterministic failures.
Logging & Triage
- Use text/CSV/curses loggers via
FuzzLoggermultiplexer for both operator visibility and artifacts. - Persist each run DB (
boofuzz-results/run-*.db) and reopen for post-campaign review. - Keep concise crash synopsis in monitor implementations (
get_crash_synopsis).
Resources
- https://github.com/jtpereyda/boofuzz
- https://boofuzz.readthedocs.io/
- https://boofuzz.readthedocs.io/en/stable/user/quickstart.html
- https://boofuzz.readthedocs.io/en/stable/user/monitors.html
- https://boofuzz.readthedocs.io/en/stable/user/protocol-definition.html
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026