CheckOps home

Tools directory

A

CheckOps

AFL++

AFL++ is the community-maintained successor to Google's AFL: a coverage-guided fuzzer with faster execution, better mutations and instrumentation, custom mutators and modes for binaries, licensed AGPL-3.0-or-later.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

AFL++ (American Fuzzy Lop plus plus) is a fork of Google’s AFL, originally developed by Michal Zalewski. Its README calls it a superior fork with more speed, more and better mutations, better instrumentation and custom module support. It is maintained by Marc Heuse, Dominik Maier and Heiko Eissfeldt, with about 6,900 GitHub stars.

Fuzzing feeds programs large numbers of mutated inputs and watches for crashes, hangs and sanitizer reports. AFL++ is coverage-guided: it instruments the target so it can keep inputs that reach new code paths and evolve them further.

Licensing: AFL++ is licensed AGPL-3.0-or-later and also contains Apache-2.0 files. The README states that everything compiled into a fuzzing harness is and will stay Apache-2.0, and an optional commercial licence is available for organisations that cannot use the AGPL.

In the quality loop, fuzzing belongs in security testing for parsers, file formats, network protocols and any code that handles untrusted input. AFL++ is also one of the engines used by OSS-Fuzz.

Features

  1. Coverage-guided fuzzing: Evolves inputs that reach new code.
  2. Compiler instrumentation: LLVM and GCC based instrumentation modes.
  3. Binary-only modes: QEMU, FRIDA and other modes for targets without source.
  4. Custom mutators: Plug in structure-aware mutation.
  5. Persistent mode: Fuzz in-process for much higher speed.
  6. Parallel fuzzing: Run many instances that share findings.
  7. Sanitizer support: Combine with ASan, UBSan and others to catch memory bugs.
  8. Tooling: Corpus minimisation and crash triage utilities.

Pros

  1. State of the art: Widely used in research and industry.
  2. Flexible: Source and binary-only targets.
  3. Fast: Persistent mode and optimisations.
  4. Free: Open source.
  5. Active: Commits in November 2026.

Cons

  1. Harness work: You need to write fuzz targets.
  2. Compute heavy: Good results need hours or days of CPU.
  3. Triage effort: Crashes need analysis and deduplication.
  4. AGPL: Check licence obligations for the tool itself.
  5. Native focus: Best for C/C++ and binaries; other languages have dedicated fuzzers.

Build a target with AFL++ instrumentation and fuzz it:

CC=afl-clang-fast ./configure && make
mkdir in && echo "seed" > in/seed
afl-fuzz -i in -o out -- ./target @@

Tips: start with a small, valid seed corpus, enable a sanitizer build, use persistent mode where possible, and run fuzzing continuously (for example via OSS-Fuzz for open-source projects).

Resources:

Pricing

AFL++ is free and open source (AGPL-3.0-or-later, harness code Apache-2.0). An optional commercial licence is available; see the README.

  1. C/C++ developers hardening parsers and protocol code.
  2. Security researchers hunting memory-safety bugs.
  3. Teams fuzzing binaries without source.
  4. Not a fit for teams unwilling to write and maintain harnesses.

Conclusion

AFL++ is the leading open coverage-guided fuzzer, with strong instrumentation and binary-only modes.

Invest in good harnesses and seeds and run it continuously for real results.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with AFL++ side by side.