Getting Started
Path from zero to a running Nexsiz campaign against an authorised target.
Authorised use only
Nexsiz is an offensive network protocol fuzzer. Run exclusively against targets you are explicitly authorised to test, in isolated environments. See Authorised Use.
What you will do
- Install a supported Rust toolchain and build the release binary.
- Prepare a minimal seed corpus for the protocol under test.
- Launch a bounded campaign and inspect the output tree.
Prerequisites
| Requirement | Notes |
|---|---|
| Linux x86_64 | Primary platform. Frida SHM coverage and CRIU are Linux-only. |
| Rust 1.87.0+ | Pinned in rust-toolchain.toml. Required for full feature set (LibAFL). |
| Network path to target | TCP or UDP reachability; no privilege escalation required for remote fuzzing. |
| Authorisation | Written scope / ROE for the target. |
Fast path
# Clone and build (default features — libc only)
git clone https://github.com/revanakit/nexsiz.git
cd nexsiz
cargo build --release
# Minimal FTP seed
mkdir -p seeds/ftp
printf 'USER anonymous\r\nPASS guest\r\nPWD\r\nQUIT\r\n' > seeds/ftp/login.txt
# Bounded campaign (50k execs) against local FTP
./target/release/nexsiz \
-h 127.0.0.1 -p 21 -m ftp \
-s seeds/ftp -o output/ftp \
-v -x 50000
Equivalent via Makefile (uses sample seeds under sample/seeds/):
make release
make campaign-ftp HOST=127.0.0.1
What the binary does
Nexsiz is a stateful network protocol fuzzer. Each execution mutates structured protocol input, repairs integrity fields (length, checksum, framing), sends over TCP/UDP, observes the response, and feeds coverage / oracle signals back into scheduling.
- Precision over volume — semantic mutation that respects protocol grammar
- Integrity repair — post-mutation length/checksum/terminator restoration
- Hybrid feedback — black-box response observation + optional grey-box edge coverage
- NXS — optional post-event actors (repro, differential probe, chain analysis) without bloating the core
Next steps
Installation
Toolchain pin, feature flags (libafl, json-model, criu), Make targets.
Quick Start
Seed layout, first campaigns (FTP/DNS/MQTT/SMB), output tree, cleanup.
Configuration
Config file format, environment variables, CLI override precedence.
CLI Reference
Complete flag table with aliases and operational examples.