Awesome Fuzzing

Category: Themed Directories
Slug: awesome-fuzzing
Website: https://github.com/cpuu/awesome-fuzzing
Publisher: cpuu-on-github

Overview

Awesome Fuzzing is a curated, open-source directory of resources related to fuzz testing (fuzzing) for software security. It aggregates tools, frameworks, and academic literature focused on automated software testing using invalid, unexpected, or pseudo-random inputs to uncover crashes, assertion failures, and memory issues.

Features

Fuzzing Focus

• Dedicated to fuzz testing (fuzzing) and fuzz-based security testing.
• Emphasizes automated testing with invalid, unexpected, and random inputs.
• Targets programs that consume structured inputs (files, protocols, APIs, etc.).

Structured Resource Directory

• Books: Curated list of books on fuzzing and related security testing topics.
• Talks: Collection of presentations, conference talks, and lectures on fuzzing.
• Papers: Academic and research papers focused on fuzzing techniques, theory, and practice.

Research Coverage

• Focused on publications from major security venues between Jan 2008 and Jul 2019.
• Includes papers from:
  • Network and Distributed System Security Symposium (NDSS)
  • IEEE Symposium on Security and Privacy (IEEE S&P)
  • USENIX Security Symposium (USENIX Security)
  • ACM Conference on Computer and Communications Security (ACM CCS)
• Additional papers from:
  • ArXiv (with emphasis on AI/ML-assisted fuzzing)
  • Other relevant conferences and venues.

Tools Directory

Directory of currently usable, primarily open-source fuzzing tools, organized and classified using the scheme from fuzzing-survey.org (over 35 possible categories, subset selected as most relevant). Outdated and deprecated tools are excluded. Main categories include:

• File fuzzers – For applications that process files and document formats.
• Kernel fuzzers – For operating system kernels and low-level components.
• Network fuzzers – For network protocols and services.
• API fuzzers – For web APIs and other programmatic interfaces.
• JavaScript fuzzers – For JS engines and JS-heavy applications.
• Firmware fuzzers – For firmware images and embedded systems.
• Hypervisor fuzzers – For virtualization and hypervisor layers.
• CPU fuzzers – For CPU emulators, instruction sets, and low-level execution.
• Library (Lib) fuzzers – For shared libraries and reusable components.
• Web fuzzers – For web applications and HTTP-based targets.
• DOM fuzzers – For browser DOM implementations and related components.
• Argument fuzzers – For command-line arguments and process invocation interfaces.
• Blockchain fuzzers – For blockchain clients and smart contracts.
• DBMS fuzzers – For database management systems and query interfaces.

Curation & Quality

• Items are curated to be relevant to security and fuzz testing.
• Only currently usable tools are listed; outdated/deprecated entries are filtered out.
• Classification aligned with established fuzzing survey standards.

Community & Contributions

• Open to community contributions via GitHub pull requests.
• Contribution process documented in contributing.md.
• Includes a code-of-conduct.md file defining expected behavior for contributors.

Licensing

• Licensed under CC0 (public domain dedication), allowing broad reuse of the list contents.

Pricing

• Not a commercial product or service.
• Free to access and use under the CC0 license.