Awesome Fuzzing Overview

A curated list of awesome Fuzzing(or Fuzz Testing) for software security

🏠 Home · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor · 😺 cpuu/awesome-fuzzing · ⭐ 990 · 🏷️ Security

[ Daily / Weekly / Overview ]

Awesome Fuzzing

Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are used to test programs that take structured inputs.

A curated list of references to awesome Fuzzing for security testing. Additionally there is a collection of freely available academic papers, tools and so on.

Your favorite tool or your own paper is not listed? Fork and create a Pull Request to add it!

Books
Talks
Papers
Tools

Books

Fuzzing Against the Machine: Automate vulnerability research with emulated IoT devices on QEMU (2023)
Fuzzing-101 (⭐3.8k)
The Fuzzing Book (2019)
The Art, Science, and Engineering of Fuzzing: A Survey (2019) - Actually, this document is a paper, but it contains more important and essential content than any other book.
Fuzzing for Software Security Testing and Quality Assurance, 2nd Edition (2018)
Fuzzing: Brute Force Vulnerability Discovery, 1st Edition (2007)
Open Source Fuzzing Tools, 1st Edition (2007)

Talks

Fuzzing Labs - Patrick Ventuzelo - YouTube.
Effective File Format Fuzzing - Black Hat Europe 2016.
Adventures in Fuzzing - NYU Talk 2018.
Fuzzing with AFL - NDC Conferences 2018.

Papers

To achieve a well-defined scope, I have chosen to include publications on fuzzing from 4 top major security conferences (2008–2026): (i) Network and Distributed System Security Symposium (NDSS), (ii) IEEE Symposium on Security and Privacy (S&P), (iii) USENIX Security Symposium (USEC), and (iv) ACM Conference on Computer and Communications Security (CCS).

Note: Papers are selected based on whether the title contains the keyword "fuzz." If a paper is related to fuzzing but does not include "fuzz" in its title, it may have been missed. In that case, please open a Pull Request (⭐990) and it will be reviewed for inclusion.

The Network and Distributed System Security Symposium (NDSS)

2026 (13 papers)

2025 (10 papers)

2024 (7 papers)

2023 (4 papers)

2022 (4 papers)

2021 (4 papers)

2020 (4 papers)

2019 (5 papers)

2018 (4 papers)

2017 (2 papers)

2016 (1 paper)

Driller: Augmenting Fuzzing Through Selective Symbolic Execution, 2016

2008 (1 paper)

Automated Whitebox Fuzz Testing, 2008

IEEE Symposium on Security and Privacy (IEEE S&P)

2026 (14 papers)

2025 (7 papers)

2024 (14 papers)

2023 (10 papers)

2022 (5 papers)

2021 (5 papers)

2020 (5 papers)

2019 (4 papers)

2018 (3 papers)

2017 (1 paper)

Skyfire: Data-Driven Seed Generation for Fuzzing, 2017

2015 (1 paper)

Program-Adaptive Mutational Fuzzing, 2015

2010 (1 paper)

TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection, 2010

USENIX Security

2026 (4 papers)

2025 (15 papers)

2024 (12 papers)

2023 (19 papers)

2022 (14 papers)

2021 (6 papers)

2020 (10 papers)

2019 (2 papers)

2018 (3 papers)

2017 (2 papers)

2015 (1 paper)

Protocol State Fuzzing of TLS Implementations, 2015

2014 (1 paper)

Optimizing Seed Selection for Fuzzing, 2014

2013 (1 paper)

Dowsing for overflows: a guided fuzzer to find buffer boundary violations, 2013

2012 (1 paper)

Fuzzing with Code Fragments, 2012

ACM Conference on Computer and Communications Security (ACM CCS)

2025 (11 papers)

2024 (19 papers)

2023 (9 papers)

2022 (6 papers)

2021 (8 papers)

2020 (1 paper)

FREEDOM: Engineering a State-of-the-Art DOM Fuzzer, 2020

2019 (3 papers)

2018 (2 papers)

2017 (7 papers)

2016 (3 papers)

2013 (2 papers)

2012 (1 paper)

SAGE: whitebox fuzzing for security testing, 2012

2008-2009 (2 papers)

ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)

The others

Tools

A curated collection of open-source fuzzing tools, grouped by their primary testing target. Each tool appears in one category; its description identifies the relevant interfaces and techniques. Tools are selected for research relevance, availability of official implementations, and documented capabilities.

File

G2FUZZ (⭐30) (2025) - An AFL++-based fuzzer that uses LLMs to synthesize and mutate input generators for grammar-aware fuzzing of non-textual formats.
LibAFL (⭐2.6k) (2022) - A Rust framework for building custom fuzzers from reusable components, with support for multiple platforms and scaling across cores and machines.
WINNIE (⭐576) (2021) - A Windows application fuzzer that combines harness synthesis with fast process cloning to test code beyond graphical interfaces.
AFL++ (⭐6.8k) (2019) - A superior fork to Google's AFL with more speed, more and better mutations, more and better instrumentation, and custom module support.
MOpt-AFL (⭐214) (2019) - An AFL-based fuzzer that uses particle swarm optimization to adapt mutation operator selection probabilities for more effective fuzzing.
REDQUEEN (⭐401) (2019) - A binary fuzzer that uses input-to-state correspondence to overcome magic bytes and checksums without symbolic execution.
Angora (⭐957) (2018) - A mutation-based coverage guided fuzzer that increases branch coverage by solving path constraints without symbolic execution.
InsTrim (⭐84) (2018) - A lightweight instrumentation approach for AFL that uses control-flow analysis to reduce the number of instrumented basic blocks while preserving execution path distinguishability.
QSYM (⭐654) (2018) - A concolic execution engine designed for hybrid fuzzing that works with AFL to generate inputs for new execution paths.
AFLGo (⭐559) (2017) - An AFL-based directed greybox fuzzer that generates inputs to reach specified target locations in a program.
VUzzer (⭐183) (2017) - An application-aware binary fuzzer that uses static analysis and dynamic taint analysis to guide input mutations, with a 64-bit implementation.
AFLFast (⭐424) (2016) - An AFL-based greybox fuzzer that uses power schedules to focus fuzzing effort on low-frequency execution paths.
Driller (⭐981) (2016) - A hybrid fuzzer that augments AFL with selective symbolic execution using angr to generate inputs for paths that fuzzing cannot reach.
AFL (2014) - A coverage-guided fuzzer that uses instrumentation and genetic mutations to discover bugs. Its GitHub repository is archived; AFL++ is recommended for new projects.
Valgrind (2000) - A dynamic analysis framework with tools for detecting memory management and threading errors and profiling program execution.

Kernel

Moneta (⭐27) (2025) - A GPU driver fuzzer that recalls execution states captured on real hardware for ex-vivo fuzzing.
SyzSpec (⭐17) (2025) - A specification generator for Linux kernel fuzzing that uses under-constrained symbolic execution to infer syscall interfaces.
CountDown (⭐29) (2024) - A kernel fuzzer that uses shared reference counts to guide syscall sequences toward use-after-free bugs.
MOCK (⭐24) (2024) - A Linux kernel fuzzer that learns contextual dependencies between syscalls to generate context-aware test cases.
SyzTrust (⭐19) (2024) - An on-device fuzzer for IoT trusted operating systems that uses state and branch coverage to guide input generation.
VirtFuzz (⭐135) (2024) - A LibAFL-based Linux kernel fuzzer that injects inputs through VirtIO devices to test wireless stacks.
ACTOR (⭐42) (2023) - An action-guided kernel fuzzing framework that generates inputs leveraging triggered actions and their temporal relationships.
FuzzNG (⭐36) (2023) - A Linux kernel syscall fuzzer designed to minimize reliance on manually written system call descriptions.
KextFuzz (⭐97) (2023) - A fuzzing prototype for macOS kernel extensions on Apple Silicon that instruments extensions and patches entitlement checks.
SegFuzz (⭐32) (2023) - A kernel concurrency fuzzer that uses interleaving segment coverage and mutation-based thread scheduling to discover bugs.
SyzDirect (⭐41) (2023) - A directed greybox fuzzer for reaching target locations in the Linux kernel.
DR.FUZZ (⭐29) (2022) - A semantic-informed driver fuzzer that tests Linux device drivers without their hardware devices or device emulators.
Drifuzz (⭐5) (2022) - A hardware-free device driver fuzzer that combines concolic execution with high-quality initial seed generation.
FuzzUSB (⭐37) (2022) - A hybrid stateful fuzzing framework for USB gadget stacks in the Linux kernel.
StateFuzz (⭐101) (2022) - A Linux driver fuzzer that identifies state variables through static analysis and uses their values as fuzzing feedback.
NTFuzz (⭐113) (2021) - A type-aware Windows kernel fuzzer that statically analyzes system binaries to infer system call types for more effective fuzzing.
SyzGen (⭐48) (2021) - A syscall specification generator that analyzes closed-source macOS drivers to enable interface-aware fuzzing.
KRACE (⭐32) (2020) - A coverage-guided fuzzing framework that detects data races in kernel file systems by exploring concurrency through multi-threaded syscall sequences.
PeriScope (⭐71) (2019) - A probing and fuzzing framework that tests device drivers at the hardware-OS boundary through MMIO and DMA inputs.
Razzer (⭐377) (2019) - A kernel fuzzer that uses static analysis and two-phase fuzzing to detect race conditions and concurrency bugs in Linux kernels.
Hydra (⭐178) (2019) - A fuzzing framework for automatically discovering semantic bugs in file systems using input mutators, feedback engines, and customizable checkers.
Janus (⭐238) (2019) - A file system fuzzer that finds memory corruptions in Linux kernel file systems by mutating both filesystem images and syscall sequences simultaneously.
DIFUZE (⭐385) (2017) - An interface-aware fuzzer for Linux kernel drivers that automatically recovers ioctl interfaces via LLVM analysis and generates targeted test cases.
IMF (⭐112) (2017) - A kernel API fuzzer that leverages automated API model inference to discover vulnerabilities in macOS kernel APIs.
kAFL (⭐595) (2017) - A hardware-assisted x86-64 VM kernel fuzzing framework with performant VM reloads for finding OS kernel vulnerabilities.
syzkaller (⭐6.3k) (2015) - An unsupervised coverage-guided kernel fuzzer supporting FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows.
Trinity (⭐910) (2012) - A Linux system call fuzzer that generates semi-intelligent random arguments to syscalls, including valid file descriptors, flags, and range-biased values.

Libraries & APIs

Hopper (⭐266) (2023) - A library fuzzer that interprets generated API calls and learns argument constraints without requiring manually written fuzz drivers.
IvySyn - A fully-automated framework for discovering memory error vulnerabilities in Deep Learning (DL) frameworks.
GraphFuzz (⭐10) - An experimental framework for building structure-aware, library API fuzzers.

Network & Protocols

ChatAFL (⭐395) (2024) - An AFLNet-based protocol fuzzer that uses LLMs to infer message grammars, enrich seeds, and generate messages that explore new protocol states.
ResolverFuzz (⭐20) (2024) - A DNS fuzzer that combines query-response generation with differential analysis to detect non-crash vulnerabilities in resolvers.
SGFuzz (⭐99) (2022) - A libFuzzer-based fuzzer that adds state-transition feedback to explore stateful software, including network protocol implementations.

Web Applications & APIs

WuppieFuzz (⭐226) - A coverage-guided REST API fuzzer developed on top of LibAFL.
MINER (⭐44) - A REST API fuzzer that utilizes three data-driven designs working together to guide sequence generation, improve request generation quality, and capture unique errors caused by incorrect parameter usage.
RestTestGen (⭐65) - A robust tool and framework designed for automated black-box testing of RESTful web APIs.
TEFuzz (⭐19) - A tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
Witcher (⭐109) - A web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.

Browsers

FuzzOrigin (⭐18) (2022) - A browser fuzzer that tests origin handling to discover universal cross-site scripting vulnerabilities.
CorbFuzz (⭐6) (2021) - A browser security policy testing framework that synthesizes web application responses to test cross-origin response blocking implementations.
FreeDom (⭐159) (2020) - A DOM fuzzer that generates HTML documents and DOM interactions to discover browser vulnerabilities.

Compilers & Language Runtimes

RGFuzz (⭐25) (2025) - A WebAssembly runtime fuzzer that uses compiler rules to guide test generation and compares execution results across runtimes and architectures.
FuzzJIT (⭐82) (2023) - A Fuzzilli-based JavaScript engine fuzzer that uses an oracle to detect incorrect behavior introduced by JIT compilation.
CodeAlchemist (⭐243) (2019) - A JavaScript engine fuzzer that assembles code fragments while respecting semantic constraints to generate valid test programs.

Firmware & Embedded Systems

Hoedur (⭐73) (2023) - An embedded firmware fuzzer that uses multiple input streams to represent interactions with different hardware interfaces.
Fuzzware (⭐385) (2022) - A firmware fuzzer that models memory-mapped I/O accesses to test microcontroller firmware without full peripheral emulation.
FIRM-AFL (⭐463) (2019) - An IoT firmware fuzzer that combines user-mode and system-mode emulation to improve fuzzing throughput for POSIX-compatible firmware.

Hypervisors & Virtual Devices

HyperPill (⭐65) (2024) - A hypervisor fuzzer that uses the hardware virtualization interface to exercise hypervisor behavior without hypervisor-specific input grammars.
ViDeZZo (⭐40) (2023) - A virtual device fuzzing framework that models dependencies within and between messages to test devices in QEMU and VirtualBox.
V-SHUTTLE (⭐100) (2021) - An AFL-based fuzzer for virtual devices in hosted hypervisors, with semantics-aware input generation.

Hardware & Microarchitecture

DifuzzRTL (⭐101) - A differential fuzz testing approach for CPU verification.
MorFuzz (⭐52) - A generic RISC-V processor fuzzing framework that can efficiently detect software triggerable functional bugs.
SpecFuzz (⭐32) - A tool that exposes speculative execution paths through software instrumentation so fuzzers can detect Spectre-type vulnerabilities in programs.
Transynther (⭐20) - Automatically generates and tests building blocks for Meltdown attacks with various faults and microcode assists.

Android & Mobile Systems

AHA-Fuzz (⭐18) (2025) - An intent-aware greybox fuzzer that uses eBPF-based analysis to test hardened Android applications.
MALintent (⭐37) (2025) - A coverage-guided Android fuzzer that generates and mutates intents to test application intent receivers.
FANS (⭐265) - A fuzzing tool for Android native system services with four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.

Blockchain & Smart Contracts

Fluffy (⭐62) - A multi-transaction differential fuzzer for finding consensus bugs in Ethereum.
LOKI (⭐20) - A Blockchain consensus protocol fuzzing framework that detects consensus memory related and logic bugs.
ILF (⭐155) (2019) - An Ethereum smart contract fuzzer that learns a transaction-generation policy from symbolic execution through imitation learning.

DBMS

BuzzBee (⭐9) (2024) - A DBMS fuzzer that uses semantic abstraction, context-sensitive constraints, and dependency-guided mutations to generate database queries.
SQLRight (⭐66) (2022) - A DBMS fuzzer that combines coverage feedback, validity-oriented query mutations, and result-checking oracles to detect logical bugs.
Squirrel (⭐215) - A fuzzer for database management systems (DBMSs).

Contributing

Contributions welcome! Read the contribution guidelines first.