Binary fuzzing functionality

[mertcancoskuner]

Hi, I wanted to discuss implementing binary fuzzing in nuclei to make binary fuzzing more accessible would be in scope of Nuclei

[ehsandeep]

@mertcancoskuner sounds interesting, can you share more about it?

[mertcancoskuner]

Oftentimes I feel like binary fuzzing needs a lot of prior knowledge to setup and get it working e.g. https://github.com/AFLplusplus/AFLplusplus, https://github.com/google/honggfuzz, https://llvm.org/docs/LibFuzzer.html.
I was wondering if it would be possible to develop a tool or enhance Nuclei to accept binary path, target, corpus, and related settings i.e. AddressSanitizer, MemorySanitizer defined in a template, and let it take care of the setup steps to produce an output.

[ehsandeep]

@mertcancoskuner I see. Nuclei does support the file protocol, which works with local file inputs. Right now, it offers basic support, mainly allowing matchers to operate on file content, including binary files.

To enable binary fuzzing, though, I think we’d need additional changes in the engine. That could include exposing new attributes in the template to enable fuzzing behavior and give matchers/extractors access to the file content, similar to how it currently works.

[dogancanbakir]

@mertcancoskuner Thanks for opening the discussion. I believe this would be a good addition to the FILE protocol, as discussed at BHASIA2025. As @ehsandeep pointed out, we'd need to make some changes to the FILE protocol to support this. Therefore, I created an issue for it. Tracking at #6164.