Nexsiz is a stateful network protocol fuzzer designed for authorised security research, defensive testing, and red-team operations. It is dual-use by nature: the same capabilities that find protocol defects can be misused. This page states the project’s expectations.

Intended use

• Fuzzing systems you own or have explicit written authorisation to test.
• Research into protocol robustness, state-machine reachability, and crash triage.
• Red-team / purple-team exercises conducted under a defined rules of engagement.
• Development and evaluation of defensive controls (IDS/IPS signatures, protocol parsers, crash handlers).

Prohibited use

• Targeting systems without prior authorisation.
• Using Nexsiz (or NXS actors) as a weapon against third parties.
• Redistributing modified builds for the purpose of unauthorised access or disruption.
• Bypassing legal, contractual, or organisational restrictions under the guise of “research”.

Vulnerability reporting

If you discover a security defect in Nexsiz itself (e.g. unsafe parsing of untrusted model files, RPC surface issues, or privilege problems in the Frida agent):

1. Do not open a public issue with a full exploit.
2. Contact the maintainer privately (see repository owner profile).
3. Provide a minimal, reproducible description and impact assessment.
4. Allow reasonable time for a fix before public disclosure.

Operational hardening (operator responsibility)

• Run campaigns in isolated networks or VMs whenever possible.
• Restrict the RPC socket (-Y) to local, permission-controlled paths; do not expose it over the network.
• Treat crash corpora and NXS artefacts as potentially sensitive (they may contain protocol secrets or credentials from the target).
• Clean residual SHM regions (/dev/shm/nexsiz-cov*) after campaigns.
• Prefer least-privilege accounts for both the fuzzer and the target process under test.

License & liability

Nexsiz is released under the Apache License 2.0. The software is provided “as is”, without warranty of any kind. The authors and contributors are not liable for misuse, damage, or legal consequences arising from operation of the tool. Operators are solely responsible for compliance with applicable laws and organisational policy.