fuzzers

Fuzzers are software testing tools that automatically feed a program with large volumes of random, malformed, or unexpected inputs to uncover defects such as crashes, hangs, or security vulnerabilities. They are used in software development, security assessment, and assurance to identify robustness weaknesses and improve input validation. Fuzzing can target operating systems, file parsers, network protocols, and application interfaces.

Fuzzers are broadly categorized by input generation method and access to program internals. Mutation-based fuzzers start from seed inputs and apply mutations to create new test cases, while generation-based fuzzers construct inputs according to a formal grammar or protocol specification. Grey-box and white-box fuzzers use program instrumentation to observe behavior and guide input generation, with coverage-based fuzzing directing growth toward unexplored code paths.

Typical workflow: seed inputs are supplied to the instrumented program; the fuzzer runs the program and monitors for crashes, timeouts, or abnormal behavior. A feedback loop uses outcomes such as code coverage or assertion failures to score and select inputs for further mutations. Fuzzers can operate locally or distributed across multiple machines to scale testing.

Outputs include crash reproducers, hang reports, and a map of discovered vulnerabilities. Limitations include potential focus on crash-inducing inputs rather than logic bugs, difficulties with non-deterministic or highly stateful software, and the need for safe execution environments to prevent damage. Legal and ethical considerations apply when fuzzing proprietary software.

Prominent fuzzers include American Fuzzy Lop (AFL), libFuzzer, and honggfuzz, which are widely used in vulnerability research and development of fuzzing-guided testing. Fuzzers are often integrated with test harnesses, sanitizers, and continuous integration pipelines to automate security testing.