Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →trailofbits/fuzzing-dictionary
Fuzzing dictionaries guide fuzzers with domain-specific tokens.
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
2 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
I added a 128-byte dictionary entry representing a full file header, but I am running libFuzzer with -max_len=64. What will libFuzzer do with dictionary tokens that exceed the configured -max_len value?
| Checked | Without skill | With skill |
|---|---|---|
| The response states that libFuzzer ignores dictionary entries longer than -max_len. | Missed | Passed |
The instructions your model reads when the skill loads.
A fuzzing dictionary provides domain-specific tokens to guide the fuzzer toward interesting inputs. Instead of purely random mutations, the fuzzer incorporates known keywords, magic numbers, protocol commands, and format-specific strings that are more likely to reach deeper code paths in parsers, protocol handlers, and file format processors.
Dictionaries are text files containing quoted strings that represent meaningful tokens for your target. They help fuzzers bypass early validation checks and explore code paths that would be difficult to reach through blind mutation alone.
| Concept | Description |
|---|---|
| Dictionary Entry | A quoted string (e.g., "keyword") or key-value pair (e.g., kw="value") |
| Hex Escapes | Byte sequences like "\xF7\xF8" for non-printable characters |
| Token Injection | Fuzzer inserts dictionary entries into generated inputs |
| Cross-Fuzzer Format | Dictionary files work with libFuzzer, AFL++, and cargo-fuzz |
Apply this technique when:
Skip this technique when:
| Task | Command/Pattern |
|---|---|
| Use with libFuzzer | ./fuzz -dict=./dictionary.dict ... |
| Use with AFL++ | afl-fuzz -x ./dictionary.dict ... |
| Use with cargo-fuzz | cargo fuzz run fuzz_target -- -dict=./dictionary.dict |
| Extract from header | grep -o '".*"' header.h > header.dict |
| Generate from binary | strings ./binary | sed 's/^/"&/; s/$/&"/' > strings.dict |
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.