AFLNet: greybox fuzzing for stateful network protocols
Updated May 6, 2026
Coverage-guided fuzzers assume one input maps to one run, and network servers break that assumption: behaviour depends on the sequence of messages and the server's current state. AFLNet records real message exchanges, infers a state machine from the server's response codes, and mutates message sequences with coverage feedback — which is what makes protocols like FTP, RTSP and DNS practical to fuzz. The state-aware seed selection is the trick I'd steal for any protocol work.
Paper: ICST 2020
540 views