appsec.fyi

Fuzzing Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Fuzzing

Fuzz testing (fuzzing) is an automated software testing technique that sends invalid, malformed, or unexpected inputs to a system to discover bugs, crashes, and security vulnerabilities. It has become one of the most effective methods for finding memory corruption, parsing errors, and input validation flaws at scale.

Fuzzing operates on a simple principle: programs that crash on unexpected input likely have exploitable bugs. Modern fuzzers go far beyond random input generation. Coverage-guided fuzzers like AFL++, libFuzzer, and Honggfuzz use code coverage feedback to evolve inputs that explore new code paths, dramatically increasing the chance of finding deep bugs. Grammar-based fuzzers generate structurally valid inputs for complex formats like JSON, XML, HTTP, and custom protocols.

In web application security, fuzzing is used for directory and file discovery, parameter brute-forcing, and finding injection points. Tools like ffuf, wfuzz, and Burp Intruder allow rapid testing of URL paths, query parameters, headers, and form fields against wordlists. API fuzzing tools specifically target REST and GraphQL endpoints with schema-aware mutation strategies.

At the systems level, fuzzing has uncovered thousands of vulnerabilities in browsers, operating system kernels, file format parsers, network protocol implementations, and cryptographic libraries. Google's OSS-Fuzz project alone has found over 10,000 bugs across hundreds of open-source projects.

This page collects fuzzing tools, techniques, research, and guides for both web application and systems-level fuzzing.

Date Added Link Excerpt
2026-04-29 NEW 2026Firefox using advanced AI to find fix browser security flaws beginner AIFirefox is employing advanced AI to proactively identify and address browser security vulnerabilities. This innovative approach aims to streamline the process of finding and patching flaws, enhancing user security. By leveraging AI, Firefox can potentially detect a wider range of issues more efficiently than traditional methods. The goal is to create a more secure browsing experience for all users by staying ahead of potential threats. → msn.com
2026-04-24 2026Claude Mythos discovered 271 vulnerabilities in Firefox news Bug BountySecurity researcher Claude Mythos identified an extensive 271 vulnerabilities within the Firefox browser. The details of these discoveries were shared via a linked article, highlighting a significant security audit conducted by Mythos. No bug bounty payout amount was specified in the provided content. → secnews.gr
2026-04-22 2026Jazzer: Coverage-guided, in-process fuzzing for the JVM intermediateLibrary for coverage-guided, in-process fuzzing of the JVM. Jazzer integrates with JUnit 5.9.0+ and supports Linux, macOS, and Windows platforms. It leverages libFuzzer's instrumentation for mutation-based input generation, allowing developers to write fuzz tests alongside unit tests. Jazzer can run in regression or fuzzing modes, identifying crashes and storing inputs for further analysis. It also includes built-in sanitizers to detect risky behaviors during fuzzing.
2026-04-22 2026Fuzzing 100+ open source projects with OSS-Fuzz - lessons learned intermediateWriteup detailing continuous fuzzing efforts on over 100 open-source projects via OSS-Fuzz. This initiative reported 2104 bugs, including 559 security-relevant issues, with 1330 fixed. Notable findings include CVE-2020-28362 in Go-ethereum and contributions to Sudoers and Pidgin, highlighting the impact of sustained vulnerability analysis on critical software components.
2026-04-22 2026Large Language Model guided Protocol Fuzzing (NDSS) advancedTool for LLM-guided protocol fuzzing, ChatAFL leverages pre-trained large language models to extract machine-readable protocol information from natural language specifications. This engine constructs grammars for message types and mutates or predicts message sequences, significantly enhancing state and code coverage compared to state-of-the-art fuzzers like AFLNet and NSFuzz. Experiments on ProFuzzbench demonstrated ChatAFL's effectiveness in discovering previously unknown vulnerabilities in real-world protocol implementations.
2026-04-22 2026Detect Go's silent arithmetic bugs with go-panikint intermediateLibrary for detecting silent integer arithmetic bugs in Go projects. go-panikint modifies the Go compiler to transform integer overflows and truncations into explicit panics, making them detectable by fuzzers. It successfully identified an integer overflow vulnerability in the Cosmos SDK's RPC pagination logic. The library includes mechanisms to filter intentional overflows via source location whitelisting or in-code comments. → blog.trailofbits.com
2026-04-22 2026Denial of Fuzzing: Rust in the Windows kernel intermediateLibrary for fuzzing Windows kernel GDI components, utilizing WinAFL and WinAFL Pet for efficient testing. It details techniques for metafile fuzzing with Enhanced Metafile Format Plus (EMF+) and identifies a denial-of-fuzzing condition triggered by mutations. The library includes methodologies for memory dump analysis using Volatility and MemProcFS, and a client-server approach to capture and store mutated files for faster reproduction of kernel crashes.
2026-04-22 2026Bringing Fuzz Testing to Kotlin with kotlinx.fuzz beginnerLibrary for fuzz testing Kotlin applications. Developed by JetBrains Research, this fuzzer, named kotlinx.fuzz, leverages existing Java fuzzers like Jazzer to identify edge cases and uncover hidden vulnerabilities by automatically generating random or invalid inputs for target functions such as `Duration.parseIsoStringOrNull`. It simplifies the fuzzing process, offering improved configuration, execution, and result analysis for Kotlin projects.
2026-04-22 2026Advanced binary fuzzing using AFL++-QEMU and libprotobuf advancedTool for advanced binary-only fuzzing utilizing AFL++-QEMU, focusing on grammar-aware in-memory persistent fuzzing. This practical guide demonstrates step-by-step configuration, including instrumentation tuning for specific code paths and optimizing execution speed, using a case study of a weak X509 parser with a buffer overflow vulnerability in `parse_cert_buf`. It details corpus preparation with `afl-cmin` and `afl-tmin`, and explores AFL++-QEMU features like `AFL_CUSTOM_MUTATOR_LIBRARY` and persistent mode addresses for performance enhancements.
2026-04-22 2026deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses advancedTool integrating static analysis and LLM-guided fuzzing to detect memory safety vulnerabilities in Rust's unsafe code. deepSURF handles generics by substituting them with custom types and LLM-augmented harnesses for complex API interactions. Evaluation on 27 Rust crates revealed 20 known and 6 previously unknown memory safety bugs, surpassing state-of-the-art tools. → arxiv.org
2026-04-22 2026Fixing Security Vulnerabilities with AI in OSS-Fuzz intermediateLibrary that customizes the AutoCodeRover LLM agent, named CodeRover-S, for autonomously fixing security vulnerabilities detected by OSS-Fuzz. This approach leverages exploit input from fuzzing campaigns to extract dynamic call graph information and augment vulnerability reports. CodeRover-S aims to improve patch generation success rates by incorporating type-based analysis at identified faulty program locations, focusing on dynamic attributes for patch correctness over static code similarity metrics. → arxiv.org
2026-04-22 2026A Survey of Network Protocol Fuzzing: Model, Techniques and Directions intermediateSurvey of network protocol fuzzing techniques; this paper systematically reviews advancements, proposes a unified process model, and discusses techniques for syntax acquisition, test case generation, execution, monitoring, and feedback utilization. It highlights challenges unique to network protocols, such as statefulness and structured input, and points to promising research directions, referencing vulnerabilities like Heartbleed (CVE-2014-0160) found in software like OpenSSL. → arxiv.org
2026-04-22 2026Anthropic AI Finds 271 Vulnerabilities in Firefox newsAnthropic AI Finds 271 Vulnerabilities in Firefox https://ift.tt/61geSjc → letsdatascience.com
2026-04-19 2026Generative Fuzzer-Driven Vulnerability Detection in IoT Networks advancedGenerative Fuzzer-Driven Vulnerability Detection in IoT Networks
2026-04-19 2026Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs advancedAutomating Fuzz Driver Generation for Deep Learning Libraries with LLMs
2026-04-19 2026Fuzz to the Future: Uncovering Occluded Future Vulnerabilities advancedFuzz to the Future: Uncovering Occluded Future Vulnerabilities → dl.acm.org
2026-04-19 2026EdgeFuzz: A Middleware-Based Security Testing Tool intermediateEdgeFuzz: A Middleware-Based Security Testing Tool
2026-04-19 2026Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery beginnerSoftware Fuzzing: The Cornerstone of Automated Vulnerability Discovery
2026-04-16 2026Fuzzing | Testing Handbook - AppSec Guide beginnerHandbook chapter detailing fuzzing as an essential dynamic testing method for uncovering security issues and bugs. It covers starting fuzzing projects quickly, delving into advanced techniques, and selecting appropriate fuzzers. The handbook explains how to write fuzzing harnesses, interpret their outputs, and apply them to real-world C/C++ projects, discussing both blackbox and feedback-driven graybox fuzzing approaches. It also explores mutation-based evolutionary fuzzing, the de facto algorithm, and defines key terminology such as SUT, fuzzer, harness, and corpus. → appsec.guide
2026-04-16 2026API Fuzzing for Security Testing: Complete Guide intermediateLibrary for API fuzzing that automates vulnerability discovery by generating malformed, randomized, or boundary-case inputs to uncover weaknesses like injection attacks, authentication bypasses, and data exposure via error handling. It integrates into CI/CD pipelines, complementing static analysis and manual testing by detecting edge cases and logic flaws missed by traditional methods, significantly improving detection rates and reducing remediation costs.
2026-04-16 2026Recent Fuzzing Papers Collection advancedRecent Fuzzing Papers Collection
2026-04-16 2026Awesome-Fuzzing: Curated List of Fuzzing Resources beginnerLibrary collecting curated resources for learning fuzzing and exploit development, including books like "Fuzzing: Brute Force Vulnerability Discovery," courses, videos, tutorials, and vulnerable applications. It lists tools such as American Fuzzy Lop (AFL), Peach Fuzzer, honggfuzz, and Cloudfuzzer, alongside discussions of techniques like directed fuzzing and root cause analysis for vulnerabilities like integer overflows. The library also features resources on browser fuzzing frameworks like BFuzz and Grizzly.
2026-04-16 2026KernelGPT: Enhanced Kernel Fuzzing via LLMs advancedLibrary for enhanced Linux kernel fuzzing using Large Language Models to automate Syzkaller specification generation and refinement. KernelGPT analyzes kernel source code, leverages LLMs for specification creation, and uses feedback for iterative improvement. This approach has successfully identified 24 new kernel bugs, including 11 with assigned CVEs, and many of its generated specifications have been integrated into the official Syzkaller repository.
2026-04-16 2026ksmbd: Fuzzing Improvements and Vulnerability Discovery intermediateLibrary for improving fuzzing and discovering vulnerabilities in `ksmbd`, an SMB server implementation. This resource details techniques for expanding the attack surface by enabling configuration options like durable handles, oplocks, and SMB2 leases, and discusses fuzzer improvements. It specifically mentions patching NTLMv2 authentication, adjusting connection limits, and simulating valid SMB state transitions by parsing responses for TreeIDs and SessionIDs. The library also leverages protocol specifications to build grammars for commands like SMB2 IOCTL requests and explores fuzzing strategies such as focused area fuzzing to target specific code paths like `smb_check_perm_dacl`, which led to the discovery of integer overflows. → blog.doyensec.com
2026-04-16 2026AFL++ Fuzzing in Depth intermediateLibrary for instrumenting and fuzzing source code targets with AFL++. This guide details the three-step process: compiling with special compilers like `afl-clang-lto` or `afl-gcc-fast`, preparing an input corpus, and executing the fuzzing process. It also covers compiler selection based on available versions (LLVM 11+, GCC 5+) and instrumentation options such as `laf-intel`, `redqueen`, and selective instrumentation via `allowlist.txt` or `denylist.txt` to optimize fuzzing efficiency.
2026-04-16 2026The Fuzzing Book: Generating Software Tests beginnerLibrary of practical examples and executable code, "The Fuzzing Book" teaches automated software testing techniques. It covers random fuzzing, mutation-based fuzzing, and grammar-based test generation, illustrated with Python code. The resource is suitable for university courses, supplementary material, or as a developer tool, and has been credited with finding over 2,600 bugs in JavaScript interpreters for browsers like Firefox, Chrome, and Edge.
2026-04-16 2026Fuzzing101: A Step-by-Step Fuzzing Tutorial beginnerTutorial on fuzzing basics using AFL++ and Ubuntu 20.04 LTS. This resource features ten real-world targets and exercises to help learners discover vulnerabilities in software projects. It explains coverage-guided evolutionary fuzzing techniques, a method employed by popular fuzzers like AFL, libFuzzer, and HonggFuzz.
2026-04-11 2026Getting Started with Python Fuzzing Using Atheris beginnerLibrary for fuzz testing Python applications, Atheris, developed by Google, simplifies the process of finding bugs through coverage-guided randomized testing. It allows users to easily create fuzz harnesses for arbitrary Python code, utilizing `FuzzedDataProvider` to generate diverse input types such as strings, integers, and lists. The library integrates seamlessly with targets, reporting crashes like `ZeroDivisionError` when it encounters unexpected inputs, aiding developers in identifying and fixing edge-case vulnerabilities.
2026-04-11 2026Unleashing Medusa: Smart Contract Fuzzing intermediateLibrary for coverage-guided, parallel, and on-chain fuzzing of EVM smart contracts. Medusa v1, built on Geth and written in Go, uses Slither insights for smart mutational value generation and provides enhanced debugging with rich execution traces. It offers an alternative to Echidna, focusing on scalability and maintainability for faster vulnerability discovery in blockchain systems. → blog.trailofbits.com
2026-04-11 2026Mastering Boofuzz: From Basics to Advanced beginnerLibrary for stateful and stateless fuzzing, Boofuzz enables robust security testing of network protocols, file formats, and embedded systems. Leveraging Python, it supports custom protocol fuzzing with checksums like CRC32 and IPv4, and allows for multi-stage fuzzing through defined states. It includes built-in crash detection, a web interface for real-time monitoring, and examples for fuzzing HTTP POST requests and authenticated FTP sessions.
2026-04-11 2026cargo-fuzz - Testing Handbook beginnerTool for fuzzing Rust projects using Cargo, this handbook details setup and usage. It leverages libFuzzer and can automatically enable sanitizers like AddressSanitizer, which is useful for detecting memory errors in unsafe Rust code. The guide covers writing fuzz tests, initializing projects with `cargo fuzz init`, running fuzz targets with `cargo +nightly fuzz run`, and re-executing specific test cases. It also explores fuzzer options, including disabling sanitizers for performance boosts when not using unsafe Rust, and provides a real-world example fuzzing the `ogg` crate. → appsec.guide
2026-04-11 2026LLM-Based Harness Synthesis for Unfuzzed Projects advancedLibrary for LLM-based fuzzing harness synthesis that automates the creation of OSS-Fuzz and ClusterFuzzLite projects for C/C++ software. It takes a GitHub repository URL as input and generates fuzzing harnesses by first building the project using generalized build heuristics, then extracting program analysis data with Fuzz Introspector, and finally synthesizing harnesses with LLMs based on that data. The process has demonstrated coverage increases and vulnerability discovery in prior work.
2026-04-11 2026HyperHook: A Harnessing Framework for Nyx advancedFramework for Nyx-based fuzzers, HyperHook streamlines snapshot fuzzing for user-space applications by managing hypercalls, function hooks, and exception handlers for both Windows and Linux targets. It works by injecting a detour into the target function, initializing communication with the host, registering handlers, setting up an input buffer, and ultimately calling the target function with fuzz input.
2026-04-11 2026Practical Jazzer for the Snazzy Fuzzer intermediateLibrary detailing practical tips for using Jazzer, a coverage-guided, in-process fuzzer for the JVM. It covers advanced techniques for enterprise Java applications, including implementing `fuzzerInitialize` and `fuzzerTearDown` methods for setup and cleanup, utilizing method hooks with reflection to inspect application state and detect vulnerabilities like context escapes, and managing timeouts with fork mode and `-ignore_timeouts`.
2026-04-11 2026Jazzer + LibAFL: Java Fuzzing Insights intermediateLibrary for Java fuzzing, integrating LibAFL with Jazzer. This fork enhances Jazzer by replacing its LibFuzzer backend with LibAFL, incorporating custom implementations for `__sanitizer_cov_trace_cmp8_with_pc`, `__sanitizer_weak_hook_memmem`, `__sanitizer_weak_hook_strstr`, and `__sanitizer_weak_hook_compare_bytes` to improve coverage feedback and comparison analysis, addressing limitations encountered when adapting Jazzer's LibFuzzer fork to LibAFL's architecture.
2026-04-11 2026Unlocking Java Fuzzing with Jazzer beginnerLibrary for fuzzing Java applications, Jazzer leverages libFuzzer for coverage-guided, in-process fuzzing on the JVM. It comprises a native Jazzer Driver that interfaces with libFuzzer and a Jazzer Agent for runtime instrumentation within the target JVM. This setup allows Jazzer to utilize libFuzzer's mutation features and feedback mechanisms for identifying vulnerabilities in Java code.
2026-04-11 2026LibAFL - Testing Handbook beginnerLibrary for building custom fuzzers, LibAFL offers modular functionality beyond traditional AFL-based fuzzers and libFuzzer. It supports a libFuzzer drop-in replacement for easier integration and also serves as a core Rust library for creating highly customizable fuzzing solutions. Setup involves installing Clang and Rust, and configuring environment variables for specific LLVM versions. LibAFL enhances fuzzing performance with features like `SimpleRestartingEventManager` and `LlmpRestartingEventManager` for effective crash detection and multi-processing. → appsec.guide
2026-04-11 2026Fuzzing Rust Using Cargo-libafl intermediateFuzzing Rust Using Cargo-libafl
2026-04-11 2026LibAFL Tutorial beginnerLibAFL Tutorial
2026-04-11 2026G2Fuzz: Grammar-Aware Fuzzing with LLMs advancedLibrary for grammar-aware fuzzing, G2Fuzz, leverages LLMs to synthesize and mutate Python scripts that generate inputs conforming to complex, non-textual grammars like TIFF images and MP4 audio. It combines LLM-driven "holistic search" for novel input generation with traditional fuzzers like AFL++ for efficient "local search." This hybrid approach significantly enhances code coverage and bug discovery, outperforming tools such as AFL++, Fuzztruction, and FormatFuzzer on benchmarks like UNIFUZZ and FuzzBench, and has discovered bugs including those acknowledged by CVEs. → arxiv.org
2026-04-11 2026Bugs That Survive Continuous Fuzzing advancedLibrary detailing vulnerabilities that persist despite continuous fuzzing in open-source projects like Gstreamer, Poppler, and Exiv2. It highlights issues arising from insufficient code coverage, unmonitored dependencies (e.g., DjVuLibre in Poppler), and neglected encoding logic, demonstrating the ongoing need for human oversight and expertise beyond automated fuzzing initiatives like OSS-Fuzz. → github.blog
2026-04-11 2026Fuzzing Web Apps using FFUF: Complete Guide beginnerLibrary for fuzzing web applications using FFUF, covering directory discovery, subdomain enumeration, virtual host fuzzing, multi-layer extension hunting, recursive scanning, authentication testing, and API endpoint discovery. It also details workflow optimizations like rate limiting and Burp Suite integration, while warning against common pitfalls such as unauthorized testing and aggressive scanning.
2026-04-11 2026FFUF Mastery: Advanced Web Fuzzing intermediateLibrary for advanced web fuzzing using FFuf, transforming standard workflows into an optimized offensive security methodology. It details sophisticated response matching techniques, practical attack scenarios leveraging HTTP response characteristics, and provides battle-tested command snippets and visual pipeline examples for immediate implementation in security testing. Techniques include response-pattern differential analysis, multi-vector fuzzing, layered match profiles, calibration for false positive reduction, content discovery with anti-false-positive profiles, and virtual host discovery.
2026-04-11 2026Looking for RCE Bugs in the Linux Kernel advancedLibrary for fuzzing the Linux kernel externally over the network, extending the syzkaller fuzzer to inject network packets via TUN/TAP and collect coverage with KCOV. The article details the integration process, including adding pseudo-syscalls and handling network specifics like checksums and TCP connections, ultimately leading to the discovery of a one-shot RCE in a non-public kernel flavor.
2026-04-11 2026Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched advancedTool detailing Syzkaller's challenges with net/sched fuzzing, specifically addressing false positive soft lockups. The author's research revealed that Syzkaller's network namespace reset was insufficient, leaving residual state that triggered hangs. This led to the creation of the HangBuzz101 CTF challenge and the identification of several vulnerabilities, including CVE-2025-38001 and CVE-2025-38616, some of which were exploitable and contributed to significant bounty payouts. Modifications to the net/sched grammar in Syzlang were implemented to mitigate these false positives.
2026-04-11 2026Writing Harnesses - Testing Handbook intermediateHandbook on writing fuzzing harnesses, detailing techniques beyond simple byte arrays. It demonstrates how to derive complex inputs like integers and strings from raw data, using tools such as `FuzzedDataProvider` to handle variable-length consumption and parsing. The handbook also explores interleaved fuzzing, where the initial input byte steers execution through multiple related APIs, and discusses structured fuzzing concepts for improved efficiency, including integrating with formats like protobufs. Examples cover potential vulnerabilities like division by zero and buffer overflows when manipulating input data. → appsec.guide
2026-04-11 2026Secrets of Effective Fuzzing Harnesses intermediateLibrary on writing effective fuzzing harnesses, emphasizing harness scope, avoiding common pitfalls like data reuse and reinterpretation, and embracing best practices such as early input validation with tools like FuzzedDataProvider, output validation, state resetting, and stateless, efficient harness design for C/C++, GO, Python, and Rust.
2026-04-11 2026Beginner's Guide to Writing a Fuzzing Harness beginnerLibrary for writing fuzzing harnesses, this guide details connecting fuzzers like AFL++ and Honggfuzz to specific target functions. It covers identifying target functions, implementing resource management (e.g., `xmlFreeTextReader`), and performing validation checks on function return results. The entry emphasizes the iterative nature of fuzzing and the importance of a well-designed harness for maximizing code coverage and enabling targeted testing of complex APIs and non-standard input formats.
2026-04-11 2026The Art of Fuzzing: Harnessing Libraries intermediateThe Art of Fuzzing: Harnessing Libraries
2026-04-11 2026AFL++ - Testing Handbook intermediateLibrary detailing the installation and usage of AFL++, a fork of the AFL fuzzer offering enhanced performance and features for C/C++ binaries. It covers multi-core fuzzing, recommended Ubuntu and Docker environments, and compilation modes like LTO, LLVM, and GCC. The guide emphasizes system configuration scripts such as `afl-system-config` and `afl-persistent-config` for optimizing fuzzing performance, while warning against their use on production systems. It also demonstrates compilation commands using wrappers like `afl-clang-lto++` and `afl-clang-fast++`. → appsec.guide

Related Topics

Recon 206 resources Subdomain, port, and service discovery techniques RCE 411 resources Arbitrary code execution on remote target systems Burp Suite 179 resources Web security testing with Burp Suite proxy and scanner GraphQL 95 resources API security risks unique to GraphQL endpoints
Compare: SAST vs DAST · DAST vs IAST vs RASP

Frequently Asked Questions

What is the difference between dumb and smart fuzzing?
Dumb fuzzing generates random inputs with no knowledge of the target's expected format. Smart fuzzing uses coverage feedback (coverage-guided) or grammar definitions (grammar-based) to generate inputs that explore new code paths and conform to expected structures. Smart fuzzers like AFL++ and libFuzzer find deeper bugs more efficiently.
How is web fuzzing different from binary fuzzing?
Web fuzzing tests HTTP parameters, paths, and headers using wordlists and mutation rules — tools like ffuf and Burp Intruder. Binary fuzzing tests compiled programs by mutating file inputs or network data to trigger crashes — tools like AFL++, libFuzzer, and Honggfuzz. Both aim to find bugs through unexpected inputs but operate at different layers.
What has fuzzing discovered in the real world?
Fuzzing has found thousands of critical vulnerabilities. Google's OSS-Fuzz has discovered over 10,000 bugs across hundreds of open-source projects including Chrome, OpenSSL, and the Linux kernel. Heartbleed-class vulnerabilities, parser bugs in image and document formats, and memory corruption in network protocol implementations have all been found through fuzzing.

Weekly AppSec Digest

Get new resources delivered every Monday.