The newest Fuzzing resources are on the Fuzzing page. For a reading order instead of a date order, see the Fuzzing learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2022-01-10 2022 | ffuf - Fuzz Faster U Fool beginner 9 min read Recon | Library for fast web fuzzing, written in Go, that allows users to fuzz URLs, headers, and POST data using the `FUZZ` keyword. It supports features like filtering responses by size or status code, recursive scanning, timeouts per job or for the entire process, and integration with mutators like Radamsa for generating payloads. Installation is available via prebuilt binaries, Homebrew, or Go modules. |
| 2022-01-03 2022 | fuzzDicts beginner | Library of web pentesting fuzzing dictionaries, continuously updated. It includes payloads for RCE, directory traversal, user enumeration with Baidu's top 3000 Chinese surnames, common mobile numbers, and Huawei security product default credentials. The collection also features CentOS and AIX file lists for SSRF, Burp's XSS payloads, user IDs from security circles, and strong/weak password lists. It covers parameter fuzzing, API endpoints, router credentials, and file extensions, recommending tools like Burp Suite and sqlmap. |
| 2022-01-02 2022 | a c program containing vulnerable code for common types of vulnerabilities can be used to show fuzzing concepts. beginner 3 min read RCE | Program containing vulnerable code for common types of vulnerabilities such as integer overflow, out-of-bounds read/write, double free, use-after-free, memory leaks, and stack/heap exhaustion. This C program is designed to be fuzzed using tools like AFL, libafl, libfuzzer, and honggfuzz to demonstrate fuzzing concepts and discover these common vulnerability classes. |
| 2021-11-26 2021 | New differential fuzzing tool reveals novel HTTP request smuggling techniques advanced SSRF | Tool for differential fuzzing, Burp Suite reveals novel HTTP request smuggling techniques. Developed by PortSwigger, this established software toolkit has been trusted by security professionals for over 20 years, setting the standard for web security testing and fostering a thriving community of practitioners, API security experts, and bug hunters. → portswigger.net |
| 2021-11-24 2021 | Fuzzing with Scapy: Introduction to Network Protocol Fuzzing beginner Talks | Fuzzing with Scapy: Introduction to Network Protocol Fuzzing |