Awesome-Fuzzing - A curated list of fuzzing resources ( Books, cours

项目说明

Welcome to Awesome Fuzzing ![Awesome]()
===================

A curated list of fuzzing resources ( Books, courses - free and paid, , tools, tutorials and applications to practice on ) for learning Fuzzing and initial phases of Exploit De like root cause analysis.

Contents

Books

Courses

+ Free
+ Paid

+ NYU Poly Course
+ Conference talks and tutorials

Tutorials and Blogs

Tools

+ Cloud Fuzzers
+ File Format Fuzzers
+ Network Protocol Fuzzers
+ Browser Fuzzing
+ Taint Analysis
+ Symbolic Execution SAT and SMT Solvers
+ Essential Tools

Applications

Anti-Fuzzing

Directed-Fuzzing

Contributing

Awesome Fuzzing Resources

Books

*Books on fuzzing*

Fuzzing: Brute Force Discovery by Michael Sutton, Adam Greene, Pedram Amini.

Fuzzing for Software Security Testing and Quality Assurance by Ari Takanen, Charles Miller, Jared D Demott and Atte Kettunen.

Open 源码 Fuzzing Tools by by Gadi Evron and Noam Rathaus.

Gray Hat Python by Justin Seitz.

The Fuzzing Book by Andreas Zeller, Rahul Gopinath, Marcel Böhme, Gordon Fraser, and Christian Holler.

> Note: Chapter(s) in the following books are dedicated to fuzzing.

> - The Shellcoder's Handbook: Disco and Exploiting Security Holes ( Chapter 15 ) by Chris Anley, Da, Da and others.

> - iOS Hacker's Handbook - Chapter 1 Charles Miller, Dino DaiZovi, Dion Blazakis, Ralf-Philip Weinmann, and Stefan Esser.

> - IDA Pro - The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler

Courses

*Courses/Training on fuzzing*

Free

NYU Poly ( see for more ) - Made a freely by Dan Guido.

Samclass.info ( check projects section and chapter 17 ) - by Sam.

Modern Binary Exploitation ( RPISEC ) - Chapter 15 - by RPISEC.

Offensi Security - Week 6 - by W. Owen Redwood and Prof. Xiuwen Liu.

Paid

Offensi, Cracking The Perimeter ( CTP ) and Ad Windows Exploitation ( AWE )

SANS 660/760 Ad Exploit De for Penetration Testers

Exodus Intelligence - de master class

Ada Logics - Applied 源码 代码 Fuzzing

FuzzingLabs Academy (C/C++, Rust, Go fuzzing)

Signal Labs - Research & Fuzzing

* talking about fuzzing techniques, tools and best practices*

NYU Poly Course

Fuzzing 101 (Part 1) - by Mike Zusman.

Fuzzing 101 (Part 2) - by Mike Zusman.

Fuzzing 101 (2009) - by Mike Zusman.

Fuzzing - Software Security Course on Coursera - by Uni of Maryland.

Conference talks and tutorials

Attacking Antivirus Software's Kernel Driver

Fuzzing the Windows Kernel - OffensiveCon 2020

Youtube Playlist of fuzzing talks and presentations - Lots of good content in these .

Browser bug hunting - Memoirs of a last man standing - by Atte Kettunen

Co Greybox Fuzzing as Marko

DerbyCon 2016: Fuzzing basics...or how to break software

Fuzz Theory - by Brandon Falk

Tutorials and Blogs

*Tutorials and blogs which explain methodology, techniques and best practices of fuzzing*

ARMored CoreSight: Towards Efficient Binary-only Fuzzing

Fuzzing Microsoft's RDP 客户端 using Channels: O & Methodology

Fuzzing Closed Source PDF

Fuzzing Image Parsing in Windows, Part One: Color Profiles

Fuzzing Image Parsing in Windows, Part Two: Uninitialized Memory

Fuzzing Image Parsing in Windows, Part Three: RAW and HEIF

Fuzzing the Office Ecosystem

Effective File Format Fuzzing - Mateusz “j00ru” Jurczyk @ Black Hat Europe 2016, London

A year of Windows kernel font fuzzing Part-1 the results - Amazing article by Google's Project Zero, describing what it takes to do fuzzing and create fuzzers.

A year of Windows kernel font fuzzing Part-2 the techniques - Amazing article by Google's Project Zero, describing what it takes to do fuzzing and create fuzzers.

Interesting bugs and resources at fuzzing project - by fuzzing-project.org.

Fuzzing workflows; a fuzz job from start to finish - by .

A gentle introduction to fuzzing C++ 代码 with AFL and libFuzzer - by Jeff Trull.

A 15 minute introduction to fuzzing - by folks at MWR Security.

> Note: Folks at fuzzing.info has done a great job of collecting some awesome links, I'm not going to duplicate their work. I will add papers missed by them and from 2015 and 2016.
Fuzzing Papers - by fuzzing.info

Fuzzing Blogs and Books - by fuzzing.info

Root Cause Analysis of the Crash during Fuzzing - by Corelan Team.

Root cause analysis of integer flow - by Corelan Team.

Creating custom peach fuzzer publishers - by Open Security Research

7 Things to Consider Before Fuzzing a Large Open 源码 Project - by Emily Ratliff.

##### From Fuzzing to Exploit:
From fuzzing to 0-day - by Harold Rodriguez().

From crash to exploit - by Corelan Team.

##### Peach Fuzzer related tutorials

Peach Fuzzer Introductionh

Fuzzing with Peach Part 1 - by Jason Kratzer of corelan team

Fuzzing with Peach Part 2 - by Jason Kratzer of corelan team.

Auto generation of Peach pit files/fuzzers - by Frédéric Guihéry, Georges Bossert.

##### AFL Fuzzer related tutorials

Creating a fuzzing harness for FoxitReader 9.7 Con Function

50 CVEs in 50 Days: Fuzzing Adobe Reader

Fuzzing sockets, part 1: FTP servers

Fuzzing software: common challenges and potential solutions (Part 1)

Fuzzing software: ad tricks (Part 2)

Fuzzing workflows; a fuzz job from start to finish - by .

Fuzzing capstone using AFL persistent mode - by

RAM disks and saving your SSD from AFL Fuzzing

Bug Hunting with American Fuzzy Lop

Ad usage of American Fuzzy Lop with real world examples

Segfaulting Python with afl-fuzz

Fuzzing With AFL-Fuzz, a Practical Example ( AFL )

The Importance of Fuzzing...Emulators?

How Heartbleed could've been found

Filesystem Fuzzing with American Fuzzy lop

Fuzzing Perl/XS modules with AFL

How to fuzz a 服务端 with American Fuzzy Lop - by Jonathan Foote

Fuzzing with AFL Workshop - a set of challenges on real

Fuzzing 101 - PHDays

##### libFuzzer Fuzzer related tutorials

libFuzzer Tutorial

Hunting for bugs in (First Take)

libFuzzer Workshop: "Modern fuzzing of C/C++ Projects"

##### honggfuzz related tutorials

Fuzzing ImageIO

Double-Free RCE in VLC. A honggfuzz how-to

##### Spike Fuzzer related tutorials

Fuzzing with Spike to find o

Fuzzing with Spike - by samclass.info

##### FOE Fuzzer related tutorials

Fuzzing with FOE - by Samclass.info

##### SMT/SAT sol

Z3 - A guide - Getting Started with Z3: A Guide

##### Building a Feedback Fuzzer (for educational purposes)

Building A Feedback Fuzzer - by

Tools

*Tools which helps in fuzzing applications*

Cloud Fuzzers

*Fuzzers which help fuzzing in cloud en.*

Cloudfuzzer - Cloud fuzzing 框架 which makes it possible to easily run automated fuzz-testing in cloud en.

ClusterFuzzer - ClusterFuzzer, scalable open 源码 fuzzing infrastructure. It is used by Google for fuzzing Chrome Browser.

Fuzzit - Fuzzit, Continuous fuzzing as a service platform. Free for open 源码. used by open-源码 projects (systemd, radare2) and close-源码 projects. To join oss program drop a line at

File Format Fuzzers

*Fuzzers which helps in fuzzing file formats like pdf, mp3, swf etc.,*

Jackalope

Rehepapp

Newer of Rehepapp

pe-afl combines static binary instrumentation on PE binary and WinAFL

MiniFuzz - Wayback Machine link - Basic file format fuzzing 工具 by Microsoft. (No longer a on Microsoft website).

BFF from CERT - Basic Fuzzing 框架 for file formats.

AFL Fuzzer (Linux only) - American Fuzzy Lop Fuzzer by Michal Zalewski aka lcamtuf

Win AFL - A fork of AFL for fuzzing Windows binaries

Shellphish Fuzzer - A Python interface to AFL, allowing for easy injection of testcases and other functionality.

TriforceAFL - A modified of AFL that supports fuzzing for applications whose 源码 代码 not a.

AFLGo - Directed Greybox Fuzzing with AFL, to fuzz targeted locations of a program.

Peach Fuzzer - 框架 which helps to create custom dumb and smart fuzzers.

MozPeach - A fork of peach 2.7 by Mozilla Security.

Failure Obser 引擎 (FOE) - mutational file-based fuzz testing 工具 for windows applications.

rmadair - mutation based file fuzzer that uses PyDBG to monitor for signals of interest.

honggfuzz - A general-purpose, easy-to-use fuzzer with interesting analysis options. Supports feedback-dri based on 代码 co. Supports GNU/Linux, FreeBSD, Mac OSX and Android.

zzuf - A transparent application input fuzzer. It works by intercepting file operations and changing random bits in the program's input.

radamsa - A general purpose fuzzer and test case generator.

binspector - A binary format analysis and fuzzing 工具

grammarinator - Fuzzing 工具 for file formats based on ANTLR v4 grammars (lots of grammars already a from the ANTLR project).

Sloth - Sloth 🦥 is a co guided fuzzing 框架 for fuzzing Android Nati that makes use of libFuzzer and QEMU user-mode emulation.

ManuFuzzer - Binary 代码-co fuzzer for macOS, based on libFuzzer and LLVM.

Network Protocol Fuzzers

*Fuzzers which helps in fuzzing applications which use 网络 based protocals like HTTP, SSH, SMTP etc.,*

Peach Fuzzer - 框架 which helps to create custom dumb and smart fuzzers.

Sulley - A fuzzer de and fuzz testing 框架 consisting of multiple extensible components by Pedram Amini.

boofuzz - A fork and successor of Sulley 框架.

Spike - A fuzzer de 框架 like sulley, a predecessor of sulley.

Metasploit 框架 - A 框架 which contains some fuzzing capabilities modules.

Nightmare - A distributed fuzzing testing suite with web administration, supports fuzzing using 网络 protocols.

rage_fuzzer - A dumb 协议-unaware packet fuzzer/replayer.

Fuzzotron - A simple 网络 fuzzer supporting TCP, UDP and multithreading.

Mutiny - The Mutiny Fuzzing 框架 is a 网络 fuzzer that operates by replaying PCAPs through a mutational fuzzer.

Fuzzing For Worms - A fuzzing 框架 for 网络 servers.

AFL (w/ networking patch) - An unofficial american fuzzy lop capable of 网络 fuzzing.

AFLNet - A Greybox Fuzzer for 网络 Protocols (an extention of AFL).

Pulsar - 协议 Learning, Simulation and Stateful Fuzzer.

Browser Fuzzing

BFuzz - An input based, browser fuzzing 框架.
Fuzzinator - Fuzzinator Random Testing 框架
Grizzly - A cross-platform browser fuzzing 框架

Misc

*Other notable fuzzers like Kernel Fuzzers, general purpose fuzzer etc.,*

Choronzon - An e knowledge-based fuzzer

QuickFuzz - A 工具 written in Haskell designed for testing un-expected inputs of common file formats on third-party software, taking ad of off-the-shelf, well known fuzzers.

gramfuzz - A grammar-based fuzzer that lets one define complex grammars to model text and binary data formats

KernelFuzzer - Cross Platform Kernel Fuzzer 框架.

honggfuzz - A general-purpose, easy-to-use fuzzer with interesting analysis options.

Hodor Fuzzer - Yet Another general purpose fuzzer.

libFuzzer - In-process, co, e fuzzing 引擎 for targets written in C/C++.

syzkaller - Distributed, unsupervised, co Linux syscall fuzzer.

ansvif - An ad cross platform fuzzing 框架 designed to find in C/C++ 代码.

Tribble - Easy-to-use, co J framework.

go-fuzz - Co testing of go packages.

FExM - Automated Large-Scale Fuzzing 框架

Jazzer - A co, in-process fuzzer for the Ja Machine based on libFuzzer.

cifuzz - A command line 工具 for executing co fuzz tests in multiple languages and targets.

WebGL Fuzzer - WebGL Fuzzer

fast-check - A fuzzer 工具 written in TypeScript and designed to run un-expected inputs against Ja 代码.

Taint Analysis

*How user input affects the execution*

PANDA ( Platform for Architecture-Neutral Dynamic Analysis )

QIRA (QEMU Interacti Analyser)

kfetch-toolkit - 工具 to perform ad logging of memory references performed by operating systems’ kernels

moflow - A software security 框架 containing tools for , discovery, and triage.

Symbolic Execution SAT and SMT Solvers

Z3 - A theorem prover from Microsoft Research.

SMT-LIB - An international initiati at facilitating research and de in Satisfiability Modulo Theories (SMT)

Symbolic execution with KLEE: From installation and introduction to bug-finding in open 源码 software - A set of four instructional introducing KLEE, starting with how to get started with KLEE and ending with a demo that finds memory corruption bugs in real 代码.

References

I haven't included some of the legends like AxMan, please refer the following link for more information.

Essential Tools

*Tools of the trade for exploit de, reverse engineers*

#### Debuggers

Windbg - The preferred debugger by exploit writers.

Immunity Debugger - Immunity Debugger by Immunity Sec.

OllyDbg - The debugger of choice by reverse engineers and exploit writers alike.

Mona.py ( Plugin for windbg and Immunity dbg ) - Awesome tools that makes life easy for exploit de.

x64dbg - An open-源码 x64/x32 debugger for windows.

Evan's Debugger (EDB) - Front end for gdb.

GDB - Gnu Debugger - The fa linux debugger.

PEDA - Python Exploit De Assistance for GDB.

Radare2 - 框架 for re and analyzing binaries.

#### Disassemblers and some more

*Dissemblers, disassembly frameworks etc.,*

IDA Pro - The best disassembler

binnavi - Binary analysis IDE, annotates control flow graphs and call graphs of disassembled 代码.

Capstone - Capstone is a lightweight multi-platform, multi-architecture disassembly 框架.

#### Others

ltrace - Intercepts library calls

strace - Intercepts system calls

Applications

Exploit-DB -
(search and pick the exploits, which ha apps a for download, reproduce the exploit by using fuzzer of your choice)

PacketStorm -

Fuzzgoat - C program for testing fuzzers.

- A server for testing fuzzers.

##### Samples files for seeding during fuzzing:

PDF Test Corpus from Mozilla

MS Office file format documentation

Fuzzer Test Suite - Set of tests for fuzzing engines. Includes different well-known bugs such as Heartbleed, c-ares $100K bug and others.

Fuzzing Corpus - A corpus, including file formats for fuzzing multiple targets in the fuzzing literature.

Anti Fuzzing

Introduction to Anti-Fuzzing: A Defence In-Depth Aid

Fuzzification: Anti-Fuzzing Techniques

AntiFuzz: Impeding Fuzzing Audits of Binary Executables

Directed Fuzzing

Awesome Directed Fuzzing: A curated list of awesome directed fuzzing research papers.

Contributing

Please refer the guidelines at contributing.md for details.

Thanks to the following folks who made contributions to this project.
+ Tim Strazzere
+ jksecurity
+ and these awesome people

项目信息

开发语言：未知

Star 数：5918

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of fuzzing resources ( Books, courses - free and paid, , tools, tutorials and applications to practice on ) for learning Fuzzing and initial phases of Exploit De like root cause analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。