Fuzz Testing
The corpus is the fuzzer's accumulated learning — a collection of inputs that together exercise the target's reachable code space. Corpus quality determines fuzzing quality. A poorly seeded corpus means the fuzzer spends days rediscovering what valid inputs look like. A bloated corpus means millions of redundant
Fuzz Testing
Fuzzing's reputation is built on results. The technique has found some of the most significant software vulnerabilities of the past 30 years — not because it's clever, but because it's systematic and relentless. These case studies examine real-world bugs found by fuzzing, what each
Fuzz Testing
Coverage-guided fuzzing finds more bugs than random fuzzing because it learns from execution. Each input that exercises new code paths is kept; inputs that don't are discarded. Over time, the fuzzer builds a corpus that covers increasingly deep program states. Understanding how this works internally — instrumentation, coverage
Fuzz Testing
Fuzz testing (fuzzing) automatically generates random, malformed, or unexpected inputs and feeds them to your program looking for crashes, hangs, memory corruption, and assertion violations. Modern coverage-guided fuzzers like AFL++ and LibFuzzer generate millions of test cases per second guided by code coverage feedback and have found thousands of
Fuzz Testing
Basic AFL++ usage — compile with afl-clang-fast, create a seed corpus, run afl-fuzz — finds bugs.
LibFuzzer
LibFuzzer is LLVM's built-in coverage-guided fuzzer for C and C++. Unlike AFL++, which runs as a separate process, LibFuzzer runs inside your program's process — making it 10-20x faster. It's integrated directly into Clang, requires no external tools, and is used by
AFL++
AFL++ (American Fuzzy Lop++) is the most widely used coverage-guided fuzzer for C and C++ programs. It instruments your binary at compile time to track code coverage, then mutates inputs guided by that coverage to explore your program's logic exhaustively. Used by Google, Mozilla, and security researchers
Testing
OSS-Fuzz is Google's free continuous fuzzing service for open source software.
Testing
AFL++ is the most widely used coverage-guided fuzzer. It's responsible for finding thousands of CVEs in real-world software — in image parsers, network libraries, file format handlers, and more. This tutorial walks through everything you need to go from installation to finding actual bugs. Installation Ubuntu/Debian:
Fuzz Testing
libFuzzer is a coverage-guided fuzzing engine built directly into LLVM/Clang.
Fuzz Testing
Hypothesis is the most accessible entry point to property-based and fuzz testing for Python developers.
Fuzz Testing
Go 1.18 shipped something remarkable: built-in fuzz testing integrated directly into go test.