Track Awesome Fuzzing Updates Weekly
A curated list of awesome Fuzzing(or Fuzz Testing) for software security
🏠 Home · 🔍 Search · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor · 😺 cpuu/awesome-fuzzing · ⭐ 990 · 🏷️ Security
Sep 21 - Sep 27, 2026
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
- SmuFuzz: Enable Deep System Management Mode Fuzzing in Fully Featured UEFI Runtime Environment, 2026
Papers / USENIX Security
Tools / File
- G2FUZZ (⭐30) (2025) - An AFL++-based fuzzer that uses LLMs to synthesize and mutate input generators for grammar-aware fuzzing of non-textual formats.
- LibAFL (⭐2.6k) (2022) - A Rust framework for building custom fuzzers from reusable components, with support for multiple platforms and scaling across cores and machines.
- WINNIE (⭐576) (2021) - A Windows application fuzzer that combines harness synthesis with fast process cloning to test code beyond graphical interfaces.
- MOpt-AFL (⭐214) (2019) - An AFL-based fuzzer that uses particle swarm optimization to adapt mutation operator selection probabilities for more effective fuzzing.
- REDQUEEN (⭐401) (2019) - A binary fuzzer that uses input-to-state correspondence to overcome magic bytes and checksums without symbolic execution.
- InsTrim (⭐84) (2018) - A lightweight instrumentation approach for AFL that uses control-flow analysis to reduce the number of instrumented basic blocks while preserving execution path distinguishability.
- QSYM (⭐654) (2018) - A concolic execution engine designed for hybrid fuzzing that works with AFL to generate inputs for new execution paths.
- AFLGo (⭐559) (2017) - An AFL-based directed greybox fuzzer that generates inputs to reach specified target locations in a program.
- VUzzer (⭐183) (2017) - An application-aware binary fuzzer that uses static analysis and dynamic taint analysis to guide input mutations, with a 64-bit implementation.
- AFLFast (⭐424) (2016) - An AFL-based greybox fuzzer that uses power schedules to focus fuzzing effort on low-frequency execution paths.
- Driller (⭐981) (2016) - A hybrid fuzzer that augments AFL with selective symbolic execution using angr to generate inputs for paths that fuzzing cannot reach.
- AFL (2014) - A coverage-guided fuzzer that uses instrumentation and genetic mutations to discover bugs. Its GitHub repository is archived; AFL++ is recommended for new projects.
- Valgrind (2000) - A dynamic analysis framework with tools for detecting memory management and threading errors and profiling program execution.
Tools / Kernel
- Moneta (⭐27) (2025) - A GPU driver fuzzer that recalls execution states captured on real hardware for ex-vivo fuzzing.
- SyzSpec (⭐17) (2025) - A specification generator for Linux kernel fuzzing that uses under-constrained symbolic execution to infer syscall interfaces.
- CountDown (⭐29) (2024) - A kernel fuzzer that uses shared reference counts to guide syscall sequences toward use-after-free bugs.
- MOCK (⭐24) (2024) - A Linux kernel fuzzer that learns contextual dependencies between syscalls to generate context-aware test cases.
- SyzTrust (⭐19) (2024) - An on-device fuzzer for IoT trusted operating systems that uses state and branch coverage to guide input generation.
- VirtFuzz (⭐135) (2024) - A LibAFL-based Linux kernel fuzzer that injects inputs through VirtIO devices to test wireless stacks.
- FuzzNG (⭐36) (2023) - A Linux kernel syscall fuzzer designed to minimize reliance on manually written system call descriptions.
- KextFuzz (⭐97) (2023) - A fuzzing prototype for macOS kernel extensions on Apple Silicon that instruments extensions and patches entitlement checks.
- SegFuzz (⭐32) (2023) - A kernel concurrency fuzzer that uses interleaving segment coverage and mutation-based thread scheduling to discover bugs.
- SyzDirect (⭐41) (2023) - A directed greybox fuzzer for reaching target locations in the Linux kernel.
- DR.FUZZ (⭐29) (2022) - A semantic-informed driver fuzzer that tests Linux device drivers without their hardware devices or device emulators.
- Drifuzz (⭐5) (2022) - A hardware-free device driver fuzzer that combines concolic execution with high-quality initial seed generation.
- FuzzUSB (⭐37) (2022) - A hybrid stateful fuzzing framework for USB gadget stacks in the Linux kernel.
- StateFuzz (⭐101) (2022) - A Linux driver fuzzer that identifies state variables through static analysis and uses their values as fuzzing feedback.
- SyzGen (⭐48) (2021) - A syscall specification generator that analyzes closed-source macOS drivers to enable interface-aware fuzzing.
- PeriScope (⭐71) (2019) - A probing and fuzzing framework that tests device drivers at the hardware-OS boundary through MMIO and DMA inputs.
Tools / Libraries & APIs
- Hopper (⭐266) (2023) - A library fuzzer that interprets generated API calls and learns argument constraints without requiring manually written fuzz drivers.
Tools / Network & Protocols
- ChatAFL (⭐395) (2024) - An AFLNet-based protocol fuzzer that uses LLMs to infer message grammars, enrich seeds, and generate messages that explore new protocol states.
- ResolverFuzz (⭐20) (2024) - A DNS fuzzer that combines query-response generation with differential analysis to detect non-crash vulnerabilities in resolvers.
- SGFuzz (⭐99) (2022) - A libFuzzer-based fuzzer that adds state-transition feedback to explore stateful software, including network protocol implementations.
Tools / Browsers
- FuzzOrigin (⭐18) (2022) - A browser fuzzer that tests origin handling to discover universal cross-site scripting vulnerabilities.
- FreeDom (⭐159) (2020) - A DOM fuzzer that generates HTML documents and DOM interactions to discover browser vulnerabilities.
Tools / Compilers & Language Runtimes
- RGFuzz (⭐25) (2025) - A WebAssembly runtime fuzzer that uses compiler rules to guide test generation and compares execution results across runtimes and architectures.
- FuzzJIT (⭐82) (2023) - A Fuzzilli-based JavaScript engine fuzzer that uses an oracle to detect incorrect behavior introduced by JIT compilation.
- CodeAlchemist (⭐243) (2019) - A JavaScript engine fuzzer that assembles code fragments while respecting semantic constraints to generate valid test programs.
Tools / Firmware & Embedded Systems
- Hoedur (⭐73) (2023) - An embedded firmware fuzzer that uses multiple input streams to represent interactions with different hardware interfaces.
- Fuzzware (⭐385) (2022) - A firmware fuzzer that models memory-mapped I/O accesses to test microcontroller firmware without full peripheral emulation.
- FIRM-AFL (⭐463) (2019) - An IoT firmware fuzzer that combines user-mode and system-mode emulation to improve fuzzing throughput for POSIX-compatible firmware.
Tools / Hypervisors & Virtual Devices
- HyperPill (⭐65) (2024) - A hypervisor fuzzer that uses the hardware virtualization interface to exercise hypervisor behavior without hypervisor-specific input grammars.
- ViDeZZo (⭐40) (2023) - A virtual device fuzzing framework that models dependencies within and between messages to test devices in QEMU and VirtualBox.
- V-SHUTTLE (⭐100) (2021) - An AFL-based fuzzer for virtual devices in hosted hypervisors, with semantics-aware input generation.
Tools / Android & Mobile Systems
- AHA-Fuzz (⭐18) (2025) - An intent-aware greybox fuzzer that uses eBPF-based analysis to test hardened Android applications.
- MALintent (⭐37) (2025) - A coverage-guided Android fuzzer that generates and mutates intents to test application intent receivers.
Tools / Blockchain & Smart Contracts
- ILF (⭐155) (2019) - An Ethereum smart contract fuzzer that learns a transaction-generation policy from symbolic execution through imitation learning.
Tools / DBMS
- BuzzBee (⭐9) (2024) - A DBMS fuzzer that uses semantic abstraction, context-sensitive constraints, and dependency-guided mutations to generate database queries.
- SQLRight (⭐66) (2022) - A DBMS fuzzer that combines coverage feedback, validity-oriented query mutations, and result-checking oracles to detect logical bugs.
Jul 13 - Jul 19, 2026
Papers / USENIX Security
May 25 - May 31, 2026
Tools / Web Applications & APIs
- WuppieFuzz (⭐226) - A coverage-guided REST API fuzzer developed on top of LibAFL.
Apr 13 - Apr 19, 2026
Books
- Fuzzing Against the Machine: Automate vulnerability research with emulated IoT devices on QEMU (2023)
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
Papers / USENIX Security
- CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks, 2025
- WhisperFuzz: White-Box Fuzzing for Detecting and Locating Timing Vulnerabilities in Processors, 2024
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
- RIoTFuzzer: Companion App Assisted Remote Fuzzing for Detecting Vulnerabilities in IoT Devices, 2024
Tools / Kernel
- ACTOR (⭐42) (2023) - An action-guided kernel fuzzing framework that generates inputs leveraging triggered actions and their temporal relationships.
- NTFuzz (⭐113) (2021) - A type-aware Windows kernel fuzzer that statically analyzes system binaries to infer system call types for more effective fuzzing.
- KRACE (⭐32) (2020) - A coverage-guided fuzzing framework that detects data races in kernel file systems by exploring concurrency through multi-threaded syscall sequences.
- Razzer (⭐377) (2019) - A kernel fuzzer that uses static analysis and two-phase fuzzing to detect race conditions and concurrency bugs in Linux kernels.
- Hydra (⭐178) (2019) - A fuzzing framework for automatically discovering semantic bugs in file systems using input mutators, feedback engines, and customizable checkers.
- Janus (⭐238) (2019) - A file system fuzzer that finds memory corruptions in Linux kernel file systems by mutating both filesystem images and syscall sequences simultaneously.
- DIFUZE (⭐385) (2017) - An interface-aware fuzzer for Linux kernel drivers that automatically recovers ioctl interfaces via LLVM analysis and generates targeted test cases.
- IMF (⭐112) (2017) - A kernel API fuzzer that leverages automated API model inference to discover vulnerabilities in macOS kernel APIs.
- kAFL (⭐595) (2017) - A hardware-assisted x86-64 VM kernel fuzzing framework with performant VM reloads for finding OS kernel vulnerabilities.
- syzkaller (⭐6.3k) (2015) - An unsupervised coverage-guided kernel fuzzer supporting FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows.
- Trinity (⭐910) (2012) - A Linux system call fuzzer that generates semi-intelligent random arguments to syscalls, including valid file descriptors, flags, and range-biased values.
Nov 20 - Nov 26, 2023
Tools / Libraries & APIs
- IvySyn - A fully-automated framework for discovering memory error vulnerabilities in Deep Learning (DL) frameworks.
- GraphFuzz (⭐10) - An experimental framework for building structure-aware, library API fuzzers.
Tools / Web Applications & APIs
- MINER (⭐44) - A REST API fuzzer that utilizes three data-driven designs working together to guide sequence generation, improve request generation quality, and capture unique errors caused by incorrect parameter usage.
- RestTestGen (⭐65) - A robust tool and framework designed for automated black-box testing of RESTful web APIs.
- TEFuzz (⭐19) - A tailored fuzzing-based framework to facilitate the detection and exploitation of template escape bugs.
- Witcher (⭐109) - A web application fuzzer that utilizes mutational fuzzing to explore web applications and fault escalation to detect command and SQL injection vulnerabilities.
Tools / Browsers
- CorbFuzz (⭐6) (2021) - A browser security policy testing framework that synthesizes web application responses to test cross-origin response blocking implementations.
Tools / Hardware & Microarchitecture
- DifuzzRTL (⭐101) - A differential fuzz testing approach for CPU verification.
- MorFuzz (⭐52) - A generic RISC-V processor fuzzing framework that can efficiently detect software triggerable functional bugs.
- SpecFuzz (⭐32) - A tool that exposes speculative execution paths through software instrumentation so fuzzers can detect Spectre-type vulnerabilities in programs.
- Transynther (⭐20) - Automatically generates and tests building blocks for Meltdown attacks with various faults and microcode assists.
Tools / Android & Mobile Systems
- FANS (⭐265) - A fuzzing tool for Android native system services with four components: interface collector, interface model extractor, dependency inferer, and fuzzer engine.
Tools / Blockchain & Smart Contracts
- Fluffy (⭐62) - A multi-transaction differential fuzzer for finding consensus bugs in Ethereum.
- LOKI (⭐20) - A Blockchain consensus protocol fuzzing framework that detects consensus memory related and logic bugs.
Tools / DBMS
- Squirrel (⭐215) - A fuzzer for database management systems (DBMSs).
Nov 06 - Nov 12, 2023
Tools / File
- AFL++ (⭐6.8k) (2019) - A superior fork to Google's AFL with more speed, more and better mutations, more and better instrumentation, and custom module support.
- Angora (⭐957) (2018) - A mutation-based coverage guided fuzzer that increases branch coverage by solving path constraints without symbolic execution.
Jan 02 - Jan 08, 2023
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
Dec 12 - Dec 18, 2022
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
Papers / USENIX Security
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
Papers / The others
Oct 31 - Nov 06, 2022
Papers / The Network and Distributed System Security Symposium (NDSS)
Jan 24 - Jan 30, 2022
Books
Talks
- Fuzzing Labs - Patrick Ventuzelo - YouTube.
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
Papers / USENIX Security
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
Papers / The others
Oct 19 - Oct 25, 2020
Books
- The Fuzzing Book (2019)
Oct 12 - Oct 18, 2020
Papers / USENIX Security
- FuzzGuard: Filtering out Unreachable Inputs in Directed Grey-box Fuzzing through Deep Learning, 2020
Jun 15 - Jun 21, 2020
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
Mar 09 - Mar 15, 2020
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Feb 03 - Feb 09, 2020
Papers / The Network and Distributed System Security Symposium (NDSS)
Dec 23 - Dec 29, 2019
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
Aug 05 - Aug 11, 2019
Talks
- Effective File Format Fuzzing - Black Hat Europe 2016.
- Adventures in Fuzzing - NYU Talk 2018.
- Fuzzing with AFL - NDC Conferences 2018.
Jul 15 - Jul 21, 2019
Books
- The Art, Science, and Engineering of Fuzzing: A Survey (2019) - Actually, this document is a paper, but it contains more important and essential content than any other book.
Papers / IEEE Symposium on Security and Privacy (IEEE S&P)
Papers / USENIX Security
Papers / ACM Conference on Computer and Communications Security (ACM CCS)
Papers / ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Jun 17 - Jun 23, 2019
Papers / ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Mar 04 - Mar 10, 2019
Papers / The Network and Distributed System Security Symposium (NDSS)
Papers / The others
Jan 28 - Feb 03, 2019
Papers / USENIX Security
Oct 29 - Nov 04, 2018
Papers / USENIX Security
Papers / ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Papers / The others
Oct 22 - Oct 28, 2018
Books
Papers / USENIX Security
Papers / ArXiv (Fuzzing with Artificial Intelligence & Machine Learning)
Papers / The others