fuzzer

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

testing security instrumentation qemu fuzzing fuzz-testing afl afl-fuzz fuzzer unicorn-emulator afl-fuzzer afl-gcc fuzzer-afl afl-compiler unicorn-mode

UpdatedNov 5, 2025
C

google /syzkaller

Star5.9k

syzkaller is an unsupervised coverage-guided kernel fuzzer

testing linux security kernel fuzzing fuzz-testing security-vulnerability fuzzer security-tools

UpdatedNov 4, 2025
Go

antonio-morales /Fuzzing101

Star3.6k

An step by step fuzzing tutorial. A GitHub Security Lab initiative

testing education security hacking fuzzing fuzz-testing afl afl-fuzz vulnerabilities bugbounty fuzzer bug-hunting fuzzilli

UpdatedJun 3, 2024

crytic /echidna

Star3k

Ethereum smart contract fuzzer

testing security ethereum smart-contracts solidity fuzzer evm

UpdatedNov 3, 2025
Haskell

1N3 /BlackWidow

Star1.7k

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

python application osint web spider passive scanner xss scan owasp rce sqli vulnerability csrf active bugbounty fuzzer automated lfi rfi

UpdatedNov 24, 2024
Python

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

testing security fuzzing fuzz-testing bochs fuzzer code-coverage winhv kvm-api snapshot-fuzzer bochscpu

UpdatedOct 23, 2025
C++

Endava /cats

Star1.3k

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.

java testing api rest-api swagger openapi fuzzer rest-fuzzer

UpdatedOct 25, 2025
Java

m4n3dw0lf /pythem

Star1.2k

pentest framework

docker security-audit exploit network proxy scanner phishing hacking xss sniffer packet-analyser packet-parsing brute-force packet-processing denial-of-service pentest fuzzer packet-generator spoof man-in-the-middle

UpdatedFeb 21, 2019
Python

CodeIntelligenceTesting /jazzer

Star1.2k

Coverage-guided, in-process fuzzing for the JVM

kotlin java security clojure jvm fuzzing jni fuzzer

UpdatedNov 5, 2025
Java

wireghoul /dotdotpwn

Sponsor

Star1.1k

DotDotPwn - The Directory Traversal Fuzzer

security perl traversal penetration-testing fuzzer

UpdatedSep 28, 2022
Perl

AngoraFuzzer /Angora

Star947

Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.

security symbolic-execution fuzzing afl taint-analysis fuzzer data-flow-analysis

UpdatedJul 18, 2022
C++

f4pga /prjxray

Star832

Documenting the Xilinx 7-series bit-stream format.

toolchain tools fpga xilinx vivado fuzzer xilinx-fpga bitstream artix7 artix kintex7 symbiflow

UpdatedJun 5, 2025
Python

Fuzzapi /fuzzapi

Star661

Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem

ruby rails api security automation security-vulnerability fuzzer

UpdatedFeb 25, 2021
Ruby

MozillaSecurity /funfuzz

Star638

A collection of fuzzers in a harness for testing the SpiderMonkey JavaScript engine.

fuzzer spidermonkey-engine javascript-fuzzing jsfunfuzz

UpdatedFeb 10, 2023
Python

WebFuzzing /EvoMaster

Star636

The first open-source AI-driven tool for automatically generating system-level test cases (also known as fuzzing) for web/enterprise applications. Currently targeting whitebox and blackbox testing of Web APIs, like REST, GraphQL and RPC (e.g., gRPC and Thrift).

kotlin java testing graphql rest grpc thrift evolutionary-algorithms fuzzing api-rest fuzzer api-testing rpc-api test-case-generation search-based-software-testing