The newest Fuzzing resources are on the Fuzzing page. For a reading order instead of a date order, see the Fuzzing learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-11 2026 | AFL++ - Testing Handbook intermediate 21 min read | Library detailing the installation and usage of AFL++, a fork of the AFL fuzzer offering enhanced performance and features for C/C++ binaries. It covers multi-core fuzzing, recommended Ubuntu and Docker environments, and compilation modes like LTO, LLVM, and GCC. The guide emphasizes system configuration scripts such as `afl-system-config` and `afl-persistent-config` for optimizing fuzzing performance, while warning against their use on production systems. It also demonstrates compilation commands using wrappers like `afl-clang-lto++` and `afl-clang-fast++`. → appsec.guide |
| 2026-04-11 2026 | AFL++ Tutorials beginner 1 min read | Tutorials covering AFL++ usage are available, including guides on libxml2, blackbox fuzzing with QEMU mode, and fuzzing various protocols like FTP and FreeRDP. Structured data fuzzing techniques for libprotobuf and Superion are also detailed, alongside in-depth explanations of AFL++'s inner workings and video resources for installation and practical application. |
| 2026-04-11 2026 | Fuzzing with AFL++: Exercise 1 (simple_crash) intermediate | Fuzzing with AFL++: Exercise 1 (simple_crash) |
| 2026-04-10 2026 | Fuzzing in Smart City IoT Ecosystems intermediate | Fuzzing in Smart City IoT Ecosystems |
| 2026-04-10 2026 | Multi-target Coverage-based Greybox Fuzzer advanced 56 min read | Library implementing Multi-target Coverage-based Greybox Fuzzing (MTCFuzz) for architectures where operating systems and firmware cooperate. It leverages code coverage from both components within a QEMU virtualization environment to achieve deeper system exploration than single-target fuzzing, addressing issues like those observed with OpenSBI bugs. → arxiv.org |
| 2026-04-10 2026 | A Gentle Introduction to Linux Kernel Fuzzing beginner 10 min read | Tutorial on Linux kernel fuzzing using AFL and KCOV, detailing coverage-guided techniques to discover bugs in the kernel's netlink machinery. It explains how to configure a custom Linux kernel with KCOV enabled and integrate kernel code coverage reporting into AFL, a popular fuzzer by Michał Zalewski, for effective memory corruption bug detection. The tutorial also references prior work with tools like syzkaller. → blog.cloudflare.com |
| 2026-04-10 2026 | Fuzzing Cheat Sheet: AFL++, libFuzzer, Boofuzz, WinDBG, Ghidra beginner | Fuzzing Cheat Sheet: AFL++, libFuzzer, Boofuzz, WinDBG, Ghidra |
| 2026-04-10 2026 | Fuzzing: What Are the Latest Developments? news | Library covering modern fuzzing advancements, highlighting its evolution into a core assurance technique for embedded, real-time, and safety-critical software. It details how fuzzing complements static analysis, runtime verification, and formal methods for high-integrity systems and explores recent innovations like grammar-based, hybrid, and AI-assisted fuzzing to improve defect detection and robustness. |
| 2026-04-10 2026 | A Survey of Kernel Fuzzing advanced | A Survey of Kernel Fuzzing |
| 2026-04-10 2026 | Step-by-Step Guide to Coverage-Guided Fuzzing with libFuzzer intermediate | Step-by-Step Guide to Coverage-Guided Fuzzing with libFuzzer |
| 2026-04-10 2026 | Fuzzing: Brute Force Vulnerability Discovery - ACM beginner | Fuzzing: Brute Force Vulnerability Discovery - ACM → dl.acm.org |
| 2026-04-10 2026 | Fuzzing Vulnerability Discovery Techniques - ACM intermediate | Fuzzing Vulnerability Discovery Techniques - ACM → dl.acm.org |
| 2026-04-10 2026 | Vulnerability Discovery in ICS Using Fuzzing intermediate 2 min read | Dissertation detailing strategies for fuzzing Industrial Control Systems (ICS). It presents a specialized fuzzing framework for translating PLC languages like Ladder Logic and Structured Text into C/C++, along with a reinforcement learning-driven technique for adaptive input mutation and LLMs for generating functionally diverse test cases. Silent crashes are detected using electromagnetic side-channel analysis, achieving significant improvements in crash detection, coverage, test case reduction, and silent crash identification. |
| 2026-04-10 2026 | A Directed Greybox Fuzzer for Windows Applications advanced 45 min read | Tool for directed greybox fuzzing on Windows applications, WinDGF, addresses challenges in target function localization, GUI bypassing, and fitness metric calculation. It offers two modes: WinDGF_path for deep path exploration and WinDGF_keyblock for focused defect identification. Evaluations against WinAFL and Winnie show significant improvements in unique crash discovery, with WinDGF_keyblock showing up to a 79.48% increase over WinAFL. WinDGF also successfully reproduces 11 known crash points. |
| 2026-04-10 2026 | GRLFuzz: Optimizing Mutation Strategies with Reinforcement Learning advanced | GRLFuzz: Optimizing Mutation Strategies with Reinforcement Learning |
| 2026-04-10 2026 | Fuzzing Vulnerability Discovery Techniques: Survey and Future Directions beginner | Fuzzing Vulnerability Discovery Techniques: Survey and Future Directions |
| 2026-04-10 2026 | Ultimate Guide to Fuzzing and Exploit Development beginner | Library of curated resources for mastering fuzzing and exploit development, including books, courses, video tutorials, tools, and practice labs. This comprehensive collection aids in identifying software vulnerabilities and building foundational ethical hacking skills. It emphasizes leveraging these materials, such as Awesome-Fuzzing, for accelerated learning in cybersecurity. |
| 2026-04-10 2026 | Revolutionizing Vulnerability Discovery with AI-Powered Fuzzing advanced 4 min read | Library for AI-powered fuzzing, featuring tools like cleverhans and torch-fuzz. This resource details how AI enhances vulnerability discovery by automating test case generation and improving coverage, applicable to complex systems and IoT. It offers a step-by-step guide to setting up an AI fuzzing environment and discusses best practices for effective implementation, drawing parallels to Google's Fuzz Testing and Microsoft's Security Risk Detection. |
| 2026-04-06 2026 | Enhancing REST API Fuzzing with Access Policy Violation Detection intermediate 66 min read API Sec | Library for enhancing REST API fuzzing by integrating novel automated oracles. These oracles detect violations of access policies, specifically addressing Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), alongside traditional attacks like SQL Injection and XSS. The techniques are integrated into EvoMaster, a state-of-the-art REST API fuzzer, and can generate executable test cases in multiple programming languages upon detecting security faults. Experiments demonstrate improved detection of security issues compared to existing methods. → arxiv.org |
| 2026-04-06 2026 | Fuzzing REST APIs in Industry: Necessary Features and Lessons Learned intermediate 76 min read | Tool detailing the integration of the open-source fuzzer EvoMaster into industrial REST API testing at Volkswagen AG. It shares lessons learned and discusses necessary features for academic prototypes to achieve real impact in software engineering, based on evaluations of four APIs and a user study with eleven testing specialists. → arxiv.org |
| 2026-04-03 2026 | MALF: A Multi-Agent LLM Framework for Intelligent Fuzzing advanced 43 min read | Framework MALF integrates multi-agent large language models for intelligent fuzzing of industrial control protocols like Modbus/TCP, S7Comm, and Ethernet/IP. It utilizes Retrieval-Augmented Generation and QLoRA fine-tuning for protocol-aware input generation, optimizing seed selection, mutation strategies, and feedback loops. In real-world ICS environments, MALF identified critical vulnerabilities, including zero-days registered by CNVD, surpassing traditional fuzzing methods with higher test case pass rates and improved exception trigger generation. → arxiv.org |
| 2026-04-03 2026 | Automating App Security with Advanced Fuzz Testing Techniques intermediate 5 min read | Library for automating application security through advanced fuzz testing techniques, uncovering subtle edge-case bugs and zero-day vulnerabilities. It offers detailed explanations of fuzzing's evolution, its effectiveness in finding buffer overflows, memory leaks, and denial-of-service vectors, and how to integrate it into CI/CD pipelines. The resource highlights mutation-based, generation-based, and coverage-guided fuzzing, mentioning tools like AFL++, libFuzzer, and OneFuzz, and discusses its advantages over static analysis and manual testing for proactive vulnerability discovery. |
| 2026-04-03 2026 | Coverage Guided vs Blackbox Fuzzing | ClusterFuzz intermediate 1 min read | Library for fuzzing applications, detailing coverage-guided techniques like those used by libFuzzer and AFL, and blackbox fuzzing. Coverage-guided fuzzing utilizes program instrumentation for informed input mutation to maximize code coverage, ideal for self-contained, deterministic, and fast targets like binary format parsers. Blackbox fuzzing operates without internal knowledge, suitable for large, non-deterministic, or slow targets with complex input formats, such as browser DOM fuzzers. |
| 2026-04-03 2026 | Make Fuzzing First-Class in CI/CD: Coverage-Guided Testing in 2025 intermediate 11 min read | Library for integrating coverage-guided fuzzing into CI/CD pipelines, focusing on tools like libFuzzer and AFL++. It details practical implementation steps, including effective sanitizer usage (ASan, UBSan), corpus management, and efficient crash triage. The library supports C/C++, Rust, and Go, with specific guidance on fuzzing services like HTTP, JSON, and gRPC, aiming to make fuzzing a repeatable and low-friction part of the engineering process, akin to compilers and linters. |
| 2026-04-03 2026 | How to Use Fuzzing in Security Research | Keysight beginner | How to Use Fuzzing in Security Research | Keysight |
| 2026-04-03 2026 | Fuzz Testing: A Beginner's Guide | Better Stack beginner 8 min read | Library for automated testing, fuzzing helps discover vulnerabilities by feeding random inputs to applications, excelling at finding edge cases missed by traditional methods. This guide covers mutation-based vs. generation-based fuzzing, and black-box, white-box, and gray-box approaches. It details common targets like file parsers and network protocols, recommending tools such as AFL and libFuzzer, and demonstrates practical examples of fuzzing file parsers and API endpoints. |
| 2026-04-03 2026 | libFuzzer and AFL++ | ClusterFuzz intermediate 4 min read | Library for configuring coverage-guided fuzzing with libFuzzer and AFL++. Details setting up clang compilers (version 6.0+ recommended, trunk for serious use), building fuzz targets with AddressSanitizer and fuzzing flags like `-fsanitize=fuzzer` or `-fsanitize-coverage=trace-pc-guard`, and integrating with ClusterFuzz. It covers job naming conventions for libFuzzer and AFL, custom build uploads, seed corpus inclusion, and dictionary support for token-based fuzzing enhancements. |
| 2026-04-03 2026 | libFuzzer - A Library for Coverage-Guided Fuzz Testing | LLVM intermediate 19 min read | Library for coverage-guided fuzz testing, libFuzzer is an in-process engine linked with target libraries to mutate inputs and maximize code coverage. It uses LLVM's SanitizerCoverage instrumentation and requires a matching Clang version. Fuzz targets, defined by `LLVMFuzzerTestOneInput`, must be deterministic, fast, and tolerate arbitrary inputs. libFuzzer integrates with AddressSanitizer (ASAN) and UndefinedBehaviorSanitizer (UBSAN) via compilation flags like `-fsanitize=fuzzer,address`. It utilizes a corpus of seed inputs and can merge or minimize corpora. Parallel execution with `-jobs` and `-workers` or the experimental `-fork` mode enhances fuzzing efficiency. |
| 2026-04-03 2026 | AFL - American Fuzzy Lop: A Security-Oriented Fuzzer intermediate 13 min read | Library for security-oriented fuzzing, American Fuzzy Lop (AFL) employs an instrumentation-guided genetic algorithm to identify vulnerabilities. It leverages modified edge coverage to detect program control flow changes and uses an input queue that grows as new states are discovered. AFL supports both compile-time instrumentation for source code availability and experimental binary instrumentation via QEMU user-space emulation for black-box targets. The tool generates a corpus of interesting test cases useful for other testing regimes and offers options for hardening and heap corruption detection. |
| 2026-04-03 2026 | Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster intermediate 11 min read | Library extending coverage-guided fuzzing instrumentation. This resource details modifying Fuzzilli's instrumentation for JerryScript to incorporate return addresses and symbolization of program counters, enhancing bug hunting beyond simple edge coverage. It leverages Clang's sanitizers, specifically `__sanitizer_cov_trace_pc_guard` and `__builtin_return_address`, to extract richer execution data for more effective vulnerability discovery in complex software. → blog.includesecurity.com |
| 2025-12-30 2025 | Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage. intermediate 38 min read API Sec Burp GraphQL | Library for comprehensive API security testing within Burp Suite. It consolidates 15 attack types, including BOLA, IDOR, SQL injection, XSS, and GraphQL vulnerabilities, with over 108 payloads and intelligent fuzzing capabilities. The extension offers automated reconnaissance, detects security issues across the OWASP API Top 10, and integrates with external tools like Nuclei, Turbo Intruder, SQLMap, and Dalfox. It features AI integration for payload generation and supports REST, GraphQL, and SOAP APIs. |
| 2025-08-14 2025 | NucleiFuzzer - Powerful Automation Tool For Detecting XSS, SQLi, SSRF, Open intermediate SQLi | "NucleiFuzzer is an automation tool designed to detect vulnerabilities like XSS, SQLi, SSRF, and Open. It offers powerful capabilities for automated testing and identification of security flaws in web applications." → kitploit.com |
| 2025-08-14 2025 | raminfp/fuzzer-development-with-rust beginner | Library for developing custom fuzzing tools in Rust, covering fundamental concepts like basic, general, seed, targeted, hybrid, generative, in-memory, and disk-based corpuses. It details various mutation strategies including arithmetic, bitmask, and token mutations, alongside feedback-driven approaches such as block, branch, function, loop, path, and statement coverage. This resource enables researchers to build tailored fuzzers for discovering vulnerabilities in open-source and internal codebases. |
| 2025-08-14 2025 | Fuzzing Forum beginner | Library hosting tutorials, examples, and research on fuzzing techniques, covering topics like structure-aware fuzzing with libFuzzer, AFL-based fuzzers, and the OSS-Fuzz continuous fuzzing service. It includes a glossary and details on ClusterFuzz and FuzzBench infrastructure. |
| 2024-12-31 2024 | GitHub - danialhalo/SqliSniper: Advanced Time-based Blind SQL Injection fuzzer for HTTP Headers intermediate 3 min read Python SQLi | Tool for detecting time-based blind SQL injection vulnerabilities specifically within HTTP headers. SqliSniper utilizes multi-threaded scanning to accelerate discovery and incorporates response time analysis to reduce false positives. It supports custom payloads and headers, and can send alerts to Discord webhooks upon successful detection of vulnerabilities. |
| 2024-12-21 2024 | GitHub - Cybersecurity-Ethical-Hacker/xssdynagen: 🪄 XSSDynaGen is a tool designed to analyze URLs with parameters, identify the characters allowed by the server, and generate advanced XSS payloads based on the analysis results. intermediate 6 min read XSS | Library for advanced XSS payload generation that analyzes URLs with parameters to identify server-allowed characters. It leverages AsyncIO and aiohttp for speed, supports custom character sets, and generates payloads using techniques like null bytes, Unicode encoding, and obfuscation. Features include batch processing, proxy support, rate limiting, retry logic, and JSON output, integrating with tools like paramspider and httpx-toolkit. |
| 2024-09-24 2024 | GitHub - raminfp/the-art-of-fuzzing: Application Fuzzing: Tools, Techniques, and Best Practices beginner 2 min read | Library covering application fuzzing, detailing static, dynamic, symbolic, and concolic execution techniques. It provides language-specific guidance for Python, Go, and Rust fuzzing, alongside strategies for Java applications and web technologies. The resource explores tools like `cargo-fuzz` and case studies involving libraries such as Gson and JSoup, offering best practices for integrating fuzzing into development workflows. |
| 2024-08-12 2024 | GitHub - Brum3ns/firefly: Black box fuzzer for web applications beginner 3 min read API Sec | Library for black-box fuzzing of web applications, Firefly utilizes goroutines for performance and offers advanced features like payload tampering, encoding, and request verification to refine results. It supports custom wordlists, filters responses by status codes or line counts, and allows matching specific regex patterns, with options for plaintext or JSON output, and customizable concurrency and delays. |
| 2024-08-03 2024 | Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit advanced 10 min read API Sec | Writeup detailing a technique to bypass the 1,500-byte single-packet attack limit for race conditions by combining IP fragmentation and TCP sequence number reordering. This method allows for the exploitation of vulnerabilities requiring a large number of simultaneous requests, potentially overcoming limitations like HTTP/2's SETTINGS_MAX_CONCURRENT_STREAMS by sending many large TCP packets out-of-order until the final packet with the first sequence number triggers simultaneous processing. |
| 2023-10-05 2023 | How to build custom scanners for web security research automation intermediate 5 min read Burp Recon | Tool for automating web security research, specifically focusing on detecting race conditions and information leaks. This Burp Suite extension leverages techniques like the single-packet attack to probe for anomalies and utilizes "gadgets" such as user request data embedded in JavaScript to identify vulnerabilities like race-infoleak, inspired by research on Cloudbleed and web race conditions. → portswigger.net |
| 2023-10-01 2023 | intrudir/BypassFuzzer intermediate 3 min read | Tool for fuzzing 401/403 endpoints for bypasses, performing checks via headers, path normalization, and verbs. BypassFuzzer outputs response codes and lengths, features a "smart" filter to mute repeated responses, and accepts raw HTTP requests from Burp. It saves successful request/response pairs to a SQLite database for later inspection and supports out-of-band (OOB) interactions. |
| 2023-09-03 2023 | ffuf advanced tricks - ACCEIS intermediate 14 min read API Sec | Library for advanced web application fuzzing, `ffuf` goes beyond simple directory enumeration. It supports injecting wordlists into URLs, GET/POST parameters, and HTTP headers, and can read from STDIN or use external generators like Radamsa. This resource details `ffuf`'s configuration file, enabling persistent settings for colorization, custom headers, proxy usage, and multiple simultaneous wordlists, enhancing its capabilities for penetration testing. |
| 2023-08-11 2023 | [tl;dr sec] #194 - CNAPPGoat KubeFuzz tl;dr sec swag news 6 min read | Library for deploying vulnerable-by-design cloud resources, CNAPPgoat, modularly provisions components across AWS, Azure, and GCP. Fuzzing Kubernetes Admission Controllers is enabled by KubeFuzz, a generative and mutative fuzzer designed to uncover unexpected behavior in complex admission controller setups. → tldrsec.com |
| 2023-05-29 2023 | RepeaterSearch intermediate Burp | Extension that adds a search bar to Burp Suite's Repeater tab, enabling users to find requests and/or responses containing a specific string or regular expression. This functionality helps in quickly locating relevant data within the Repeater history. |
| 2023-04-03 2023 | Download and Installation Scapy 2.4.5. documentation beginner 5 min read Python | Library for network packet manipulation, Scapy offers installation instructions for various platforms including Unix-like systems, macOS, and Windows. It details installation via pip, including options for the development version, and outlines optional dependencies for features like plotting (Matplotlib), 2D graphics (PyX), graphs (Graphviz, ImageMagick), 3D graphics (VPython-Jupyter), WEP decryption and TLS decryption (cryptography), fingerprinting (Nmap), and VOIP (SoX). The documentation also covers building Scapy's offline documentation with Sphinx and generating UML diagrams with pyreverse. |
| 2023-04-03 2023 | Scapy beginner Python | Scapy http://scapy.net/ |
| 2023-04-03 2023 | Usage Scapy 2.4.5. documentation beginner 38 min read Python | Library for crafting, sending, receiving, and dissecting network packets. It features an interactive shell, packet construction with layer stacking and field manipulation, PCAP file reading/writing, graphical dumps, set generation for multiple packet variations, and functions for sending packets at layers 2 and 3 (sendp and send). Scapy also supports multicast with scope identifiers and includes a fuzz() function for randomizing packet fields. |
| 2022-01-16 2022 | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes intermediate Recon SQLi | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes |
| 2022-01-10 2022 | Install Nuclei beginner 13 min read Recon | Tool for high-performance vulnerability scanning using YAML-based templates, Nuclei empowers users to create custom detection scenarios that minimize false positives. Supporting multiple protocols like HTTP, DNS, and TCP, it offers ultra-fast parallel processing and integrates with CI/CD pipelines, Jira, and Splunk. Its extensive template library, contributed by security professionals, covers trending vulnerabilities and allows for fine-grained filtering by author, tag, severity, and template ID. |
| 2022-01-10 2022 | Nuclei Templates beginner 1 min read Recon | Library of community-curated templates for the nuclei scanner, enabling the detection of security vulnerabilities in applications. This repository hosts official and user-contributed templates, with comprehensive documentation available for creating custom scans. The project emphasizes community involvement through template contributions, feature requests, and bug reports, fostering collaboration via GitHub discussions and an active Discord server. |