Fuzzing Resources

Fuzzing

Fuzz testing (fuzzing) is an automated software testing technique that sends invalid, malformed, or unexpected inputs to a system to discover bugs, crashes, and security vulnerabilities. It has become one of the most effective methods for finding memory corruption, parsing errors, and input validation flaws at scale.

Fuzzing operates on a simple principle: programs that crash on unexpected input likely have exploitable bugs. Modern fuzzers go far beyond random input generation. Coverage-guided fuzzers like AFL++, libFuzzer, and Honggfuzz use code coverage feedback to evolve inputs that explore new code paths, dramatically increasing the chance of finding deep bugs. Grammar-based fuzzers generate structurally valid inputs for complex formats like JSON, XML, HTTP, and custom protocols.

In web application security, fuzzing is used for directory and file discovery, parameter brute-forcing, and finding injection points. Tools like ffuf, wfuzz, and Burp Intruder allow rapid testing of URL paths, query parameters, headers, and form fields against wordlists. API fuzzing tools specifically target REST and GraphQL endpoints with schema-aware mutation strategies.

At the systems level, fuzzing has uncovered thousands of vulnerabilities in browsers, operating system kernels, file format parsers, network protocol implementations, and cryptographic libraries. Google's OSS-Fuzz project alone has found over 10,000 bugs across hundreds of open-source projects.

This page collects fuzzing tools, techniques, research, and guides for both web application and systems-level fuzzing.