zsl-fuzz: Internal Tooling for Protocol Fuzzing in OT Environments

A walkthrough of the stateful protocol fuzzer used internally for BACnet, Modbus, and proprietary OT protocol fuzzing — without causing process disruption in live environments.

Design Goals

Standard fuzzers (AFL, boofuzz) are designed for crash discovery. In OT environments, crashing a PLC or BMS controller can disrupt physical processes — HVAC shutdowns, lighting failures, or safety system trips. zsl-fuzz was built with a different priority: find parsing bugs and logic errors without taking devices offline.

Architecture

The fuzzer operates in three phases:

• Protocol learning — Passive capture of legitimate traffic to build a state model of valid message sequences
• Targeted mutation — Mutate individual fields within valid message templates, respecting protocol state machine constraints
• Health monitoring — Continuously poll the target's status registers; pause fuzzing immediately if the device enters a fault state

Protocol Support

Currently supported protocols: BACnet/IP, Modbus/TCP, KNXnet/IP, and MQTT. Each protocol module defines its own message grammar, valid state transitions, and health check mechanisms. Adding a new protocol requires implementing three interfaces: message parser, mutator, and health probe.

Results

Over the past two years, zsl-fuzz has identified 47 unique vulnerabilities across 23 products. The most common finding categories are null pointer dereferences in malformed packet handlers, integer overflows in length fields, and authentication bypasses via state machine confusion.