Fuzzing Open Source Projects

A collection of various awesome lists for hackers, pentesters and security researchers

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

Fast web fuzzer written in Go

Web path scanner

OSS-Fuzz - continuous fuzzing for open source software.

Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.

the champagne of beta embedded databases

The property-based testing library for Python

You Know, For WEB Fuzzing !

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

syzkaller is an unsupervised coverage-guided kernel fuzzer

A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

Scalable fuzzing infrastructure.

Property based testing framework for JavaScript (like QuickCheck) written in TypeScript

Randomized testing for Go

A system daemon to allow session software to update firmware

A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.

An step by step fuzzing tutorial. A GitHub Security Lab initiative

A high performance offensive security tool for reconnaissance and vulnerability scanning

Tutorials, examples, discussions, research proposals, and other resources related to fuzzing

The home of the ICU project source code.

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

Rockyou for web fuzzing

Ethereum smart contract fuzzer

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

Python tools for penetration testers

A self-hosted Fuzzing-As-A-Service platform

Web Fuzzing Box - Web 模糊测试字典与一些Payloads

Recent Fuzzing Paper

Curated list of resources on testing distributed systems

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...

A fork of AFL for fuzzing Windows binaries

This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite".

A fork and successor of the Sulley Fuzzing Framework

A JavaScript Engine Fuzzer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

awesome list of browser exploitation tutorials

Cista is a simple, high-performance, zero-copy C++ serialization & reflection library.

Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

Gryffin is a large scale web security scanning platform.

A container repository for my public web hacks!

Dictionary for penetration testers happy hacker

Command line helpers for fuzzing

🐇 Fuzzing Rust code with American Fuzzy Lop

Golang for Security Professionals

DOM fuzzer

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

Automated testing to find logic and performance bugs in database systems

PHP代码审计分段讲解

RFSec-ToolKit is a collection of Radio Frequency Communication Protocol Hacktools.无线通信协议相关的工具集，可借助SDR硬件+相关工具对无线通信进行研究。Collect with ♥ by HackSmith

Autobahn WebSocket protocol testsuite

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. - Do not use for illegal testing ;)

A toolset for reverse engineering and fuzzing Protobuf-based apps

开源、轻量、快速、跨平台 的网站漏洞扫描工具，帮助您快速检测网站安全隐患。功能 端口扫描(port scan) 指纹识别(fingerprint) 漏洞检测(nday check) 智能爆破 (admin brute) 敏感文件扫描(file fuzz)