Member-only story
Top 10 Fuzzing Tools
Hi everyone, welcome back. Today, I will be going over fuzzing tools — AFL++, libFuzzer, honggfuzz, cargo-fuzz, Go’s native fuzzing, Atheris, Jazzer, OSS-Fuzz, boofuzz, and RESTler.
Fuzzing has a reputation for being exotic, and it is one of the cheapest testing wins available. The frame to put in your head first: a fuzzer is a coverage-feedback loop, and the thing that determines whether it finds anything is the harness you write, not the fuzzer you pick. Every tool below runs the same loop — mutate an input, run the program, keep the input if it reached new code, repeat. If your target takes a byte array and hands it straight to a parser, any of these will find bugs. If it rejects ninety-nine percent of inputs on the first line because it wants a valid checksum, all ten will spin and find nothing. Everything here is about fuzzing code you own and dependencies you ship, inside your own test suite.
If you are newer to this, here is the vocabulary, because the tools assume it. Fuzzing is feeding a program large volumes of generated input to see whether it crashes or misbehaves. A fuzz target, or harness, is the small function you write that takes a blob of bytes and does something with it — the entry point the fuzzer calls repeatedly. A corpus is the directory of inputs the fuzzer keeps, and a seed is a starting input you supply by hand, usually a small valid file, so the fuzzer need not discover the format from nothing. Coverage-guided fuzzing means the fuzzer watches which branches each input reaches and prefers inputs that reach new ones, which…
