Fuzzing

repo: cpuu/awesome-fuzzing
category: Security related: Testing

Awesome Fuzzing

Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. Typically, fuzzers are used to test programs that take structured inputs.

A curated list of references to awesome Fuzzing for security testing. Additionally there is a collection of freely available academic papers, tools and so on.

Your favorite tool or your own paper is not listed? Fork and create a Pull Request to add it!

Books
Talks
Papers
Tools
Contribute

Books

Fuzzing Against the Machine: Automate vulnerability research with emulated IoT devices on QEMU (2023)
Fuzzing-101
The Fuzzing Book (2019)
The Art, Science, and Engineering of Fuzzing: A Survey (2019) - Actually, this document is a paper, but it contains more important and essential content than any other book.
[Fuzzing for Software Security Testing and Quality Assurance, 2nd Edition](https://www.amazon.com/Fuzzing-Software-Security-Testing-Assurance/dp/1608078507/) (2018)
Fuzzing: Brute Force Vulnerability Discovery, 1st Edition (2007)
Open Source Fuzzing Tools, 1st Edition (2007)

Talks

Fuzzing Labs - Patrick Ventuzelo - YouTube.
Effective File Format Fuzzing - Black Hat Europe 2016.
Adventures in Fuzzing - NYU Talk 2018.
Fuzzing with AFL - NDC Conferences 2018.

Papers

To achieve a well-defined scope, I have chosen to include publications on fuzzing from 4 top major security conferences (2008–2025): (i) Network and Distributed System Security Symposium (NDSS), (ii) IEEE Symposium on Security and Privacy (S&P), (iii) USENIX Security Symposium (USEC), and (iv) ACM Conference on Computer and Communications Security (CCS).

Note: Papers are selected based on whether the title contains the keyword "fuzz." If a paper is related to fuzzing but does not include "fuzz" in its title, it may have been missed. In that case, please open a Pull Request and it will be reviewed for inclusion.

The Network and Distributed System Security Symposium (NDSS)

<details><summary>2025 (10 papers)</summary>

Automatic Library Fuzzing through API Relation Evolvement, 2025
Blackbox Fuzzing of Distributed Systems with Multi-Dimensional Inputs and Symmetry-Based Feedback Pruning, 2025
[DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing, 2025](https://www.ndss-symposium.org/wp-content/uploads/2025-1411-paper.pdf)
FUZZUER: Enabling Fuzzing of UEFI Interfaces on EDK-2, 2025
ICSQuartz: Scan Cycle-Aware and Vendor-Agnostic Fuzzing for Industrial Control Systems, 2025
[MALintent: Coverage Guided Intent Fuzzing Framework for Android, 2025](https://www.ndss-symposium.org/wp-content/uploads/2025-125-paper.pdf)
Moneta: Ex-Vivo GPU Driver Fuzzing by Recalling In-Vivo Execution States, 2025
MSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing, 2025
Truman: Constructing Device Behavior Models from OS Drivers to Fuzz Virtual Devices, 2025
[TWINFUZZ: Differential Testing of Video Hardware Acceleration Stacks, 2025](https://www.ndss-symposium.org/wp-content/uploads/2025-526-paper.pdf)

</details>

<details><summary>2024 (7 papers)</summary>

</details>

<details><summary>2023 (4 papers)</summary>

DARWIN: Survival of the Fittest Fuzzing Mutators, 2023
[FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities, 2023](https://www.ndss-symposium.org/wp-content/uploads/2023-290-paper.pdf)
LOKI: State-Aware Fuzzing Framework for the Implementation of Blockchain Consensus Protocols, 2023
[No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Description, 2023](https://www.ndss-symposium.org/wp-content/uploads/2023-688-paper.pdf)

</details>

<details><summary>2022 (4 papers)</summary>

</details>

<details><summary>2021 (4 papers)</summary>

[WINNIE : Fuzzing Windows Applications with Harness Synthesis and Fast Cloning, 2021](https://taesoo.kim/pubs/2021/jung:winnie.pdf)
[Reinforcement Learning-based Hierarchical Seed Scheduling for Greybox Fuzzing, 2021](https://www.cs.ucr.edu/~heng/pubs/afl-hier.pdf)
PGFUZZ: Policy-Guided Fuzzing for Robotic Vehicles, 2021
[Favocado: Fuzzing Binding Code of JavaScript Engines Using Semantically Correct Test Cases, 2021](https://www.ndss-symposium.org/wp-content/uploads/ndss2021_6A-2_24224_paper.pdf)

</details>

<details><summary>2020 (4 papers)</summary>

[HFL: Hybrid Fuzzing on the Linux Kernel, 2020](https://www.unexploitable.systems/publication/kimhfl/)
HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Guided Micro-Fuzzing, 2020
HYPER-CUBE: High-Dimensional Hypervisor Fuzzing, 2020
Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization, 2020

</details>

<details><summary>2019 (5 papers)</summary>

[CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines, 2019](https://daramg.gift/paper/han-ndss2019.pdf)
PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary, 2019
REDQUEEN: Fuzzing with Input-to-State Correspondence, 2019
Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing, 2019
Life after Speech Recognition: Fuzzing Semantic Misinterpretation for Voice Assistant Applications, 2019

</details>

<details><summary>2018 (4 papers)</summary>

INSTRIM: Lightweight Instrumentation for Coverage-guided Fuzzing, 2018
IoTFuzzer: Discovering Memory Corruptions in IoT Through App-based Fuzzing, 2018
What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices, 2018
[Enhancing Memory Error Detection for Large-Scale Applications and Fuzz Testing, 2018](https://lifeasageek.github.io/papers/han:meds.pdf)

</details>

<details><summary>2017 (2 papers)</summary>

Vuzzer: Application-aware evolutionary fuzzing, 2017
[DELTA: A Security Assessment Framework for Software-Defined Networks, 2017](https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss201702A-1LeePaper.pdf)

</details>

<details><summary>2016 (1 paper)</summary>

Driller: Augmenting Fuzzing Through Selective Symbolic Execution, 2016

</details>

<details><summary>2008 (1 paper)</summary>

[Automated Whitebox Fuzz Testing, 2008](https://www.ndss-symposium.org/wp-content/uploads/2017/09/Automated-Whitebox-Fuzz-Testing-paper-Patrice-Godefroid.pdf)

</details>

IEEE Symposium on Security and Privacy (IEEE S&P)

<details><summary>2025 (7 papers)</summary>

CHIMERA: Fuzzing P4 Network Infrastructure for Multi-Plane Bug Detection and Vulnerability Discovery, 2025
FirmRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization, 2025
[Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models, 2025](https://www.computer.org/csdl/proceedings-article/sp/2025/223600a336/26hiTETXKow)
[HouseFuzz: Service-Aware Grey-Box Fuzzing for Vulnerability Detection in Linux-Based Firmware, 2025](https://www.computer.org/csdl/proceedings-article/sp/2025/223600d507/26hiVy3bGHm)
Predator: Directed Web Application Fuzzing for Efficient Vulnerability Validation, 2025
[RGFuzz: Rule-Guided Fuzzer for WebAssembly Runtimes, 2025](https://www.computer.org/csdl/proceedings-article/sp/2025/223600a003/21B7PWv1JGU)
Stateful Analysis and Fuzzing of Commercial Baseband Firmware, 2025

</details>

<details><summary>2024 (14 papers)</summary>

AFGen: Whole-Function Fuzzing for Applications and Libraries, 2024
Chronos: Finding Timeout Bugs in Practical Distributed Systems by Deep-Priority Fuzzing with Transient Delay, 2024
[DY Fuzzing: Formal Dolev-Yao Models Meet Cryptographic Protocol Fuzz Testing, 2024](https://www.computer.org/csdl/proceedings-article/sp/2024/313000a096/1Ub234bjuWA)
Everything is Good for Something: Counterexample-Guided Directed Fuzzing via Likely Invariant Inference, 2024
LABRADOR: Response Guided Directed Fuzzing for Black-box IoT Devices, 2024
LLMIF: Augmented Large Language Model for Fuzzing IoT Devices, 2024
Predecessor-aware Directed Greybox Fuzzing, 2024
SATURN: Host-Gadget Synergistic USB Driver Fuzzing, 2024
SoK: Prudent Evaluation Practices for Fuzzing, 2024
SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing, 2024
SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices, 2024
Titan: Efficient Multi-target Directed Greybox Fuzzing, 2024
[To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices, 2024](https://www.computer.org/csdl/proceedings-article/sp/2024/313000a024/1RjEa0y9RMQ)
Towards Smart Contract Fuzzing on GPU, 2024

</details>

<details><summary>2023 (10 papers)</summary>

[TEEzz: Fuzzing Trusted Applications on COTS Android Devices, 2023](https://hexhive.epfl.ch/publications/files/23Oakland.pdf)
SEGFUZZ: Segmentizing Thread Interleaving to Discover Kernel Concurrency Bugs through Fuzzing, 2023
RSFuzzer: Discovering Deep SMI Handler Vulnerabilities in UEFI Firmware with Hybrid Fuzzing, 2023
Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities, 2023
UTOPIA: Automatic Generation of Fuzz Driver using Unit Tests, 2023
SelectFuzz: Efficient Directed Fuzzing with Selective Path Exploration, 2023
[Finding Specification Blind Spots via Fuzz Testing, 2023](https://www.computer.org/csdl/proceedings-article/sp/2023/933600c708/1OXH7BohI2Y)
[ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing, 2023](https://www.computer.org/csdl/proceedings-article/sp/2023/933600c726/1OXH0xA0Lrq)
VIDEZZO: Dependency-aware Virtual Device Fuzzing, 2023
DEVFUZZ: Automatic Device Model-Guided Device Driver Fuzzing, 2023

</details>

<details><summary>2022 (5 papers)</summary>

PATA: Fuzzing with Path Aware Taint Analysis, 2022
Jigsaw: Efficient and Scalable Path Constraints Fuzzing, 2022
[FuzzUSB: Hybrid Stateful Fuzzing of USB Gadget Stacks, 2022](https://github.com/purseclab/fuzzusb/blob/main/paper/fuzzusb.pdf)
[Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis, 2022](https://arxiv.org/pdf/2203.12064.pdf)
BEACON : Directed Grey-Box Fuzzing with Provable Path Pruning, 2022

</details>

<details><summary>2021 (5 papers)</summary>

STOCHFUZZ: Sound and Cost-effective Fuzzing of Stripped Binaries by Incremental and Stochastic Rewriting, 2021
[One Engine to Fuzz 'em All: Generic Language Processor Testing with Semantic Validation, 2021](https://huhong789.github.io/papers/polyglot-oakland2021.pdf)
[NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis, 2021](https://softsec.kaist.ac.kr/~jschoi/data/oakland2021.pdf)
[DIFUZZRTL: Differential Fuzz Testing to Find CPU Bugs, 2021](https://lifeasageek.github.io/papers/jaewon-difuzzrtl.pdf)
[DIANE: Identifying Fuzzing Triggers in Apps to Generate Under-constrained Inputs for IoT Devices, 2021](https://conand.me/publications/redini-diane-2021.pdf)