BSides Munich 2026

Fuzzing network protocols often runs straight into a wall. Mutation fuzzers such as AFL++ for example blindly break the rigid grammar these protocols demand, so the target parser rejects the input at the surface long before any deeper logic is reached. To build a valid input (aka seeds) which a mutation fuzzer can work with, a seed corpus is needed. Building a valid, diverse seed collection by hand is tedious, because the protocol rules might be scattered across more than a hundred related RFCs. Security researchers typically do this manually or need to build complex grammars or rely on existing corpora. Recent work to ease the work was throwing an LLM at the problem, but zero-shot prompting creates a new set of problems like hallucinations for example.

In this talk, I present an open-source pipeline as part of my completed Bachelor's Thesis that grounds seed generation in the specification itself. A single LangGraph-based agent retrieves exact Grammar rules of text-based network protocols and data from a vector database of complete RFCs, then generates seeds and validates them against a deterministic Wireshark-based validator. To measure seed quality, we replay each corpus deterministically against SIP protocol parsers and compare code coverage against zero-shot prompting the LLM seeds and real captured traffic. The result is a clear map rather than another 'LLMs fix fuzzing' headline. Our evaluation shows that this Retrieval Augmented Generation (RAG) based approach discovers deeper code paths in syntax-heavy parsers than both zero-shot LLM prompting and corpora built from real-world traffic captures.