A curated list of awesome Fuzzing(or Fuzz Testing) for software security
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are…
(2019)
(2019) - Actually, this document is a paper, but it contains more important and essential content than any other book.
YouTube.
Black Hat Europe 2016.
NYU Talk 2018.
NDC Conferences 2018.
(2025) - An AFL++-based fuzzer that uses LLMs to synthesize and mutate input generators for grammar-aware fuzzing of non-textual formats.
(2022) - A Rust framework for building custom fuzzers from reusable components, with support for multiple platforms and scaling across cores and machines.
(2021) - A Windows application fuzzer that combines harness synthesis with fast process cloning to test code beyond graphical interfaces.
(2019) - A superior fork to Google's AFL with more speed, more and better mutations, more and better instrumentation, and custom module support.
(2019) - An AFL-based fuzzer that uses particle swarm optimization to adapt mutation operator selection probabilities for more effective fuzzing.
(2019) - A binary fuzzer that uses input-to-state correspondence to overcome magic bytes and checksums without symbolic execution.
(2018) - A mutation-based coverage guided fuzzer that increases branch coverage by solving path constraints without symbolic execution.
(2018) - A lightweight instrumentation approach for AFL that uses control-flow analysis to reduce the number of instrumented basic blocks while preserving execution path distinguishability.
(2018) - A concolic execution engine designed for hybrid fuzzing that works with AFL to generate inputs for new execution paths.
(2017) - An AFL-based directed greybox fuzzer that generates inputs to reach specified target locations in a program.
(2017) - An application-aware binary fuzzer that uses static analysis and dynamic taint analysis to guide input mutations, with a 64-bit implementation.
(2016) - An AFL-based greybox fuzzer that uses power schedules to focus fuzzing effort on low-frequency execution paths.
(2016) - A hybrid fuzzer that augments AFL with selective symbolic execution using angr to generate inputs for paths that fuzzing cannot reach.
(2014) - A coverage-guided fuzzer that uses instrumentation and genetic mutations to discover bugs. Its GitHub repository is archived; AFL++ is recommended for new projects.
(2025) - A GPU driver fuzzer that recalls execution states captured on real hardware for ex-vivo fuzzing.
(2025) - A specification generator for Linux kernel fuzzing that uses under-constrained symbolic execution to infer syscall interfaces.
(2024) - A kernel fuzzer that uses shared reference counts to guide syscall sequences toward use-after-free bugs.
(2024) - A Linux kernel fuzzer that learns contextual dependencies between syscalls to generate context-aware test cases.
(2024) - An on-device fuzzer for IoT trusted operating systems that uses state and branch coverage to guide input generation.
(2024) - A LibAFL-based Linux kernel fuzzer that injects inputs through VirtIO devices to test wireless stacks.
(2023) - An action-guided kernel fuzzing framework that generates inputs leveraging triggered actions and their temporal relationships.
(2023) - A Linux kernel syscall fuzzer designed to minimize reliance on manually written system call descriptions.
(2023) - A fuzzing prototype for macOS kernel extensions on Apple Silicon that instruments extensions and patches entitlement checks.
(2023) - A kernel concurrency fuzzer that uses interleaving segment coverage and mutation-based thread scheduling to discover bugs.
(2023) - A directed greybox fuzzer for reaching target locations in the Linux kernel.
(2022) - A semantic-informed driver fuzzer that tests Linux device drivers without their hardware devices or device emulators.
(2022) - A hardware-free device driver fuzzer that combines concolic execution with high-quality initial seed generation.
(2022) - A Linux driver fuzzer that identifies state variables through static analysis and uses their values as fuzzing feedback.
(2021) - A type-aware Windows kernel fuzzer that statically analyzes system binaries to infer system call types for more effective fuzzing.
(2021) - A syscall specification generator that analyzes closed-source macOS drivers to enable interface-aware fuzzing.
(2020) - A coverage-guided fuzzing framework that detects data races in kernel file systems by exploring concurrency through multi-threaded syscall sequences.
(2019) - A probing and fuzzing framework that tests device drivers at the hardware-OS boundary through MMIO and DMA inputs.
(2019) - A kernel fuzzer that uses static analysis and two-phase fuzzing to detect race conditions and concurrency bugs in Linux kernels.
(2019) - A fuzzing framework for automatically discovering semantic bugs in file systems using input mutators, feedback engines, and customizable checkers.
(2019) - A file system fuzzer that finds memory corruptions in Linux kernel file systems by mutating both filesystem images and syscall sequences simultaneously.
(2017) - An interface-aware fuzzer for Linux kernel drivers that automatically recovers ioctl interfaces via LLVM analysis and generates targeted test cases.
(2017) - A kernel API fuzzer that leverages automated API model inference to discover vulnerabilities in macOS kernel APIs.
(2017) - A hardware-assisted x86-64 VM kernel fuzzing framework with performant VM reloads for finding OS kernel vulnerabilities.
(2015) - An unsupervised coverage-guided kernel fuzzer supporting FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows.
(2012) - A Linux system call fuzzer that generates semi-intelligent random arguments to syscalls, including valid file descriptors, flags, and range-biased values.
(2023) - A library fuzzer that interprets generated API calls and learns argument constraints without requiring manually written fuzz drivers.
A fully-automated framework for discovering memory error vulnerabilities in Deep Learning (DL) frameworks.
An experimental framework for building structure-aware, library API fuzzers.
(2024) - An AFLNet-based protocol fuzzer that uses LLMs to infer message grammars, enrich seeds, and generate messages that explore new protocol states.
(2024) - A DNS fuzzer that combines query-response generation with differential analysis to detect non-crash vulnerabilities in resolvers.
(2022) - A libFuzzer-based fuzzer that adds state-transition feedback to explore stateful software, including network protocol implementations.
A coverage-guided REST API fuzzer developed on top of LibAFL.
A REST API fuzzer that utilizes three data-driven designs working together to guide sequence generation, improve request generation quality, and capture unique errors caused by incorrect parameter usage.
A robust tool and framework designed for automated black-box testing of RESTful web APIs.
A tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
A web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.
(2022) - A browser fuzzer that tests origin handling to discover universal cross-site scripting vulnerabilities.
(2021) - A browser security policy testing framework that synthesizes web application responses to test cross-origin response blocking implementations.
(2020) - A DOM fuzzer that generates HTML documents and DOM interactions to discover browser vulnerabilities.
(2025) - A WebAssembly runtime fuzzer that uses compiler rules to guide test generation and compares execution results across runtimes and architectures.
(2023) - A Fuzzilli-based JavaScript engine fuzzer that uses an oracle to detect incorrect behavior introduced by JIT compilation.
(2019) - A JavaScript engine fuzzer that assembles code fragments while respecting semantic constraints to generate valid test programs.
(2023) - An embedded firmware fuzzer that uses multiple input streams to represent interactions with different hardware interfaces.
(2022) - A firmware fuzzer that models memory-mapped I/O accesses to test microcontroller firmware without full peripheral emulation.
(2019) - An IoT firmware fuzzer that combines user-mode and system-mode emulation to improve fuzzing throughput for POSIX-compatible firmware.
(2024) - A hypervisor fuzzer that uses the hardware virtualization interface to exercise hypervisor behavior without hypervisor-specific input grammars.
(2023) - A virtual device fuzzing framework that models dependencies within and between messages to test devices in QEMU and VirtualBox.
(2021) - An AFL-based fuzzer for virtual devices in hosted hypervisors, with semantics-aware input generation.
A differential fuzz testing approach for CPU verification.
A generic RISC-V processor fuzzing framework that can efficiently detect software triggerable functional bugs.
A tool that exposes speculative execution paths through software instrumentation so fuzzers can detect Spectre-type vulnerabilities in programs.
Automatically generates and tests building blocks for Meltdown attacks with various faults and microcode assists.
(2025) - An intent-aware greybox fuzzer that uses eBPF-based analysis to test hardened Android applications.
(2025) - A coverage-guided Android fuzzer that generates and mutates intents to test application intent receivers.
A fuzzing tool for Android native system services with four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
A multi-transaction differential fuzzer for finding consensus bugs in Ethereum.
A Blockchain consensus protocol fuzzing framework that detects consensus memory related and logic bugs.
(2019) - An Ethereum smart contract fuzzer that learns a transaction-generation policy from symbolic execution through imitation learning.
(2024) - A DBMS fuzzer that uses semantic abstraction, context-sensitive constraints, and dependency-guided mutations to generate database queries.
(2022) - A DBMS fuzzer that combines coverage feedback, validity-oriented query mutations, and result-checking oracles to detect logical bugs.
A fuzzer for database management systems (DBMSs).
awesome-selfhosted/awesome-selfhosted
A list of Free Software network services and web applications which can be hosted on your own servers
edoardottt/awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
lissy93/awesome-privacy
🦄 A curated list of privacy & security-focused software and services
vavkamil/awesome-bugbounty-tools
A curated list of various bug bounty tools
ashishb/android-security-awesome
A collection of android security related resources
qazbnm456/awesome-web-security
🐶 A curated list of Web Security materials and resources.