Open-source fuzzing software
92 open-source libraries, tools and applications tagged fuzzing, ranked by how closely fuzzing is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
92 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| google/oss-fuzz OSS-Fuzz is Google's free continuous fuzzing service for open source software, combining fuzzing engines like libFuzzer, AFL++, and Honggfu… | 77 | 12743 | active |
| Foundry Foundry is a fast, portable, modular toolkit for Ethereum smart contract development written in Rust, comprising Forge (build/test/fuzz/dep… | 99 | 10674 | stable |
| HypothesisWorks/hypothesis Hypothesis is the property-based testing library for Python, generating randomized test inputs from user-described strategies and shrinking… | 96 | 9092 | stable |
| AFL++ AFL++ is a superior, actively maintained fork of American Fuzzy Lop, a coverage-guided fuzzer with many mutators, power schedules, and inst… | 92 | 6782 | active |
| google/syzkaller syzkaller is an unsupervised coverage-guided kernel fuzzer originally built for the Linux kernel and now supporting FreeBSD, Fuchsia, gViso… | 77 | 6352 | active |
| elceef/dnstwist dnstwist is a Python command-line tool that generates permutations of a domain name (typos, homoglyphs, IDN tricks) and checks which ones r… | 26 | 5758 | active |
| google/clusterfuzz ClusterFuzz is Google's scalable fuzzing infrastructure that finds security and stability bugs in software, serving as the backend for OSS-… | 95 | 5613 | active |
| dubzzz/fast-check fast-check is a property-based testing framework for JavaScript and TypeScript, inspired by QuickCheck. It automatically generates test inp… | 98 | 5193 | active |
| taviso/loadlibrary A library that lets native Linux programs load and call functions from Windows DLLs via a custom PE/COFF loader with a dlopen-like API. It … | 35 | 4507 | active |
| schemathesis/schemathesis Schemathesis is a Python-based API testing tool that automatically generates test cases from OpenAPI and GraphQL schemas using property-bas… | 96 | 3680 | active |
| model-checking/kani Kani is a bit-precise model checker for Rust that formally verifies safety and correctness properties of Rust programs. It uses proof harne… | 93 | 3504 | active |
| google/honggfuzz Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in bin… | 66 | 3397 | active |
| crytic/echidna Echidna is a Haskell-based fuzzer for Ethereum smart contracts that performs property-based testing by generating sequences of contract cal… | 86 | 3186 | active |
| DynamoRIO/dynamorio DynamoRIO is a runtime code manipulation system that supports arbitrary code transformations on executing programs, with a powerful instruc… | 95 | 3181 | active |
| klee/klee KLEE is a dynamic symbolic execution engine and symbolic virtual machine built on LLVM, which executes programs with symbolic inputs to aut… | 88 | 2985 | active |
| microsoft/restler-fuzzer RESTler is the first stateful REST API fuzzing tool, automatically testing cloud services through their REST APIs to find security and reli… | 67 | 2946 | active |
| BurntSushi/quickcheck A Rust library for automated property-based testing that randomly generates inputs for property functions and shrinks failing cases to mini… | 62 | 2803 | stable |
| LibAFL LibAFL is a Rust library of reusable building blocks for constructing custom coverage-guided fuzzers, developed by the AFL++ team. It scale… | 90 | 2649 | active |
| googleprojectzero/winafl WinAFL is a Windows fork of American Fuzzy Lop (AFL) for coverage-guided fuzzing of Windows binaries, including closed-source black-box tar… | 61 | 2612 | active |
| jtpereyda/boofuzz boofuzz is a Python-based network protocol fuzzing framework and the successor to the Sulley Fuzzing Framework. It provides data generation… | 66 | 2365 | active |
| googleprojectzero/fuzzilli Fuzzilli is a coverage-guided fuzzer for JavaScript engines, built in Swift by Google Project Zero. It generates test programs via a custom… | 67 | 2354 | active |
| marmelab/gremlins.js gremlins.js is a JavaScript monkey testing library for Node.js and the browser that unleashes random user-like actions (clicking, typing, s… | 23 | 9096 | maintenance |
| proptest-rs/proptest A Rust crate providing Hypothesis-like property-based testing with automatic test case shrinking. It generates random inputs to verify that… | 66 | 2244 | stable |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 86 | 2063 | active |
| typelevel/scalacheck ScalaCheck is a property-based testing library for Scala and Java programs, inspired by Haskell's QuickCheck. It generates test cases autom… | 85 | 1964 | stable |
| rust-fuzz/cargo-fuzz cargo-fuzz is a Cargo subcommand that makes it easy to fuzz test Rust code with libFuzzer. It scaffolds fuzz targets, runs them, minimizes … | 75 | 1902 | active |
| rust-fuzz/afl.rs afl.rs is a Cargo subcommand that lets you fuzz test Rust code with AFLplusplus, the coverage-guided fuzzer. It instruments Rust builds so … | 72 | 1848 | active |
| wtf wtf (what the fuzz) is a distributed, code-coverage guided, snapshot-based fuzzer for attacking user- and kernel-mode targets on Windows an… | 82 | 1800 | active |
| sqlancer/sqlancer SQLancer is a Java-based automated testing tool that finds logic and performance bugs in database management systems. It generates SQL test… | 68 | 1761 | active |
| google/atheris Atheris is a coverage-guided fuzzing engine for Python code and native CPython extensions, built on top of libFuzzer. It instruments Python… | 68 | 1688 | active |
| Microsoft Coyote Coyote is a .NET library and CLI tool from Microsoft Research for systematically testing concurrent C# code and deterministically reproduci… | 73 | 1598 | active |
| cyberark/FuzzyAI FuzzyAI is an automated LLM fuzzing tool from CyberArk that tests LLM APIs for jailbreak vulnerabilities. It ships as a Python CLI with a w… | 48 | 1587 | active |
| google/oss-fuzz-gen A Google framework that uses large language models to automatically generate fuzz targets for real-world C/C++, Java, and Python projects, … | 55 | 1443 | active |
| Dropnation/contract-fuzzer A Python-based fuzzer for Ethereum smart contracts that compiles Solidity sources and executes random sequences of public/external calls to… | 75 | 1413 | active |
| Jackalope Jackalope is a customizable, coverage-guided fuzzer for black-box binaries built on the TinyInst instrumentation library by Google Project … | 73 | 1386 | active |
| 0xacb/recollapse REcollapse is a Python CLI helper tool that generates fuzzing payloads for black-box regex fuzzing against web applications. It helps bypas… | 42 | 1380 | active |
| Endava/cats CATS (Contract API Testing and Security) is a REST API fuzzer and negative testing tool for OpenAPI endpoints. It automatically generates, … | 92 | 1374 | active |
| chipsalliance/riscv-dv RISCV-DV is a SystemVerilog/UVM-based random instruction sequence generator for verifying RISC-V processor designs. It produces randomized … | 75 | 1363 | active |
| go-fuzz go-fuzz is a coverage-guided fuzzing tool for testing Go packages with randomized inputs. It is mainly useful for hardening code that parse… | 32 | 4848 | maintenance |
| pschanely/CrossHair CrossHair is a Python analysis tool that verifies functions against type annotations and contracts using symbolic execution backed by an SM… | 95 | 1333 | active |
| CodeIntelligenceTesting/jazzer Jazzer is a coverage-guided, in-process fuzz testing engine for the JVM, based on libFuzzer. It integrates with JUnit 5 and build tools lik… | 83 | 1260 | active |
| fscheck/FsCheck FsCheck is a property-based testing library for .NET, ported from Haskell's QuickCheck. Programmers specify properties that functions shoul… | 92 | 1252 | active |
| Fastbot Fastbot is a model-based GUI testing tool for Android apps that models GUI transitions using machine learning and reinforcement learning to… | 41 | 1210 | active |
| google/fuzzbench FuzzBench is a free Google-run service and framework that rigorously evaluates fuzzers on real-world benchmarks at large scale. It provides… | 57 | 1207 | active |
| google/AFL American Fuzzy Lop (AFL) is a security-oriented, coverage-guided fuzzer that uses compile-time instrumentation and genetic algorithms to di… | 10 | 4198 | maintenance |
| reversenseorg/dexcalibur Reversense (Dexcalibur 2) is a binary intelligence platform that automates reverse engineering of mobile and embedded applications. It comb… | 66 | 1175 | active |
| fuzzland/ityfuzz ItyFuzz is a blazing-fast bytecode-level hybrid fuzzer for EVM and MoveVM smart contracts that combines symbolic (concolic) execution with … | 51 | 1120 | active |
| emil-e/rapidcheck RapidCheck is a C++ framework for property based testing inspired by QuickCheck. It generates random test data to verify stated properties,… | 76 | 1111 | stable |
| awslabs/shuttle Shuttle is a Rust library for testing concurrent code using randomized concurrency scheduling techniques with probabilistic bug-finding gua… | 99 | 1076 | active |
| google/fuzztest FuzzTest is a C++ testing framework for writing fuzz tests, which are property-based tests executed with coverage-guided fuzzing under the … | 85 | 1064 | active |
| aflnet/aflnet AFLNet is a greybox fuzzer for network protocol server implementations, extending American Fuzzy Lop with state-feedback derived from serve… | 39 | 1014 | active |
| dapptools Dapptools is a suite of Unix-philosophy CLI tools for Ethereum smart contract development, including dapp (build/test/fuzz/deploy), seth (E… | 23 | 2123 | maintenance |
| marcotcr/checklist CheckList is a Python library for behavioral testing of NLP models, implementing the ACL 2020 paper 'Beyond Accuracy: Behavioral Testing of… | 32 | 2051 | maintenance |
| zalando/SwiftMonkey SwiftMonkey is a Swift framework for randomised monkey testing of iOS apps, generating random user input events through Xcode's UI testing … | 10 | 1931 | maintenance |
| googleprojectzero/domato Domato is a grammar-based DOM fuzzer from Google Project Zero that generates HTML, CSS, and JavaScript test cases for finding browser DOM e… | 32 | 1786 | maintenance |
| marin-m/pbtk pbtk (Protobuf toolkit) is a Python-based set of scripts with a unified GUI for extracting Protobuf data structures from programs (Java run… | 94 | 1683 | maintenance |
| jsverify/jsverify JSVerify is a property-based testing library for JavaScript, inspired by Haskell's QuickCheck. It generates random test inputs, verifies us… | 23 | 1659 | maintenance |
| google/gofuzz A Go library for populating Go objects with random values, useful for fuzz-style testing of serialization and panic robustness. It also int… | 10 | 1493 | maintenance |
| typelift/SwiftCheck SwiftCheck is a property-based testing library for Swift, porting the Haskell QuickCheck approach. It automatically generates random test d… | 23 | 1427 | maintenance |
| aoh/radamsa Radamsa is a general-purpose fuzzer that mutates input data to test software robustness against malformed input. This GitHub repository is … | 23 | 1297 | maintenance |
| c0ny1/upload-fuzz-dic-builder A Python CLI script that generates fuzzing dictionaries for testing file upload vulnerabilities. It tailors wordlists based on target detai… | 32 | 1279 | maintenance |
| antirez/rax Rax is a fully featured radix tree (trie) implementation written in portable ANSI C99, originally created for Redis. It emphasizes a balanc… | 32 | 1270 | maintenance |
| csmith-project/csmith Csmith is a random generator of C programs whose primary purpose is finding compiler bugs via differential testing. It emits C programs fre… | 60 | 1249 | maintenance |
| leebyron/testcheck-js TestCheck.js is a generative (property-based) testing library for JavaScript, inspired by QuickCheck. It runs properties against many rando… | 23 | 1170 | maintenance |
| wireghoul/dotdotpwn DotDotPwn is a flexible directory traversal fuzzer written in Perl that discovers path traversal vulnerabilities in HTTP, FTP, and TFTP ser… | 23 | 1113 | maintenance |
| c0ny1/jsEncrypter A Burp Suite extension that uses PhantomJS to invoke front-end JavaScript encryption functions on payloads, enabling fuzzing and brute-forc… | 23 | 1065 | maintenance |
| antithesishq/bombadil Bombadil is a property-based testing tool for web and terminal UIs that autonomously explores and validates correctness properties. It is b… | 83 | 1532 | experimental |
| microsoft/onefuzz OneFuzz is a self-hosted Fuzzing-As-A-Service platform that lets developers launch continuous fuzzing jobs from a few VMs to thousands of c… | 10 | 2823 | abandoned |
| carteb/carte-blanche Carte Blanche is a webpack plugin that provides an isolated development space for UI components with integrated fuzz testing, letting devel… | 10 | 1493 | abandoned |
| OpenRCE/sulley Sulley is a pure-Python fuzzing engine and framework for automated, unattended fuzz testing of network protocols and targets. It handles da… | 23 | 1450 | abandoned |
| jopohl/urh Universal Radio Hacker (URH) is a complete open-source suite for investigating wireless protocols, with native support for many common Soft… | 10 | 12592 | active |
| Hardhat Hardhat is an Ethereum development environment for compiling, deploying, testing, and debugging Solidity smart contracts, built on a Rust-p… | 94 | 8509 | active |
| yaklang/yakit Yakit is an all-in-one interactive application security testing platform built as a GUI client for the Yaklang security DSL engine over gRP… | 93 | 7786 | active |
| jepsen-io/jepsen Jepsen is a Clojure library and framework for verifying the correctness of distributed systems under fault injection. It sets up systems on… | 95 | 7528 | active |
| ticarpi/jwt_tool A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known J… | 28 | 6770 | active |
| AidLux (AidLearning) AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 63 | 5812 | active |
| OpenWiFi Open-source full-stack IEEE 802.11/Wi-Fi design based on Software Defined Radio, including a Linux mac80211-compatible driver and software,… | 66 | 4809 | active |
| s0md3v/XSStrike XSStrike is a Python command-line Cross Site Scripting (XSS) detection suite that uses hand-written HTML/JavaScript parsers, context analys… | 27 | 15197 | maintenance |
| learnhouse/learnhouse LearnHouse is a next-generation open-source learning management system (LMS) for creating, sharing, and selling educational content. It com… | 100 | 2404 | active |
| msoedov/agentic_security Agentic Security is an open-source LLM vulnerability scanner and AI red-teaming toolkit that probes large language models and agent workflo… | 83 | 2004 | active |
| 0xKayala/NucleiFuzzer NucleiFuzzer is a Python-based automation tool that combines URL discovery tools (ParamSpider, Waybackurls, Gauplus, Hakrawler, Katana) wit… | 63 | 1863 | active |
| RUB-NDS/PRET PRET is a Python command-line toolkit for printer security testing that connects to devices via network (port 9100) or USB and exploits pri… | 32 | 4311 | maintenance |
| ethereum/execution-specs An executable Python reference implementation of Ethereum's Execution Layer (EELS), including the EVM and consensus-critical behavior, with… | 95 | 1200 | active |
| vanhauser-thc/thc-ipv6 A comprehensive IPv6 attack toolkit written in C, providing dozens of tools for spoofing, man-in-the-middle, denial-of-service, scanning, a… | 54 | 1200 | active |
| evyatarmeged/Raccoon Raccoon is a Python-based offensive security CLI tool for reconnaissance and information gathering. It performs DNS lookups, WHOIS, TLS ana… | 64 | 4047 | maintenance |
| segmentio/encoding A Go library providing high-performance encoders and decoders for data formats, most notably a drop-in replacement for the standard library… | 80 | 1056 | active |
| greatscottgadgets/facedancer A Python library for emulating USB devices using hardware peripherals like Cynthion or GreatFET. It also supports MITM proxying of USB conn… | 73 | 1031 | active |
| Microsoft Quantum Development Kit The Microsoft Quantum Development Kit provides tooling for the Q# quantum programming language, including a compiler, language service, sta… | 94 | 1024 | active |
| taviso/ctftool An interactive command-line tool for exploring the CTF (Clipboard/Text Services Framework) protocol used by Windows Text Services. It suppo… | 23 | 1668 | maintenance |
| veo/vscan vscan is an open-source, lightweight, fast, cross-platform website vulnerability scanner written in Go, built for red team reconnaissance. … | 23 | 1629 | maintenance |
| Hans-Halverson/brimstone Brimstone is a JavaScript engine written from scratch in Rust, implementing nearly the full ECMAScript specification (ES2026) including a b… | 77 | 1322 | experimental |
| vaycore/OneScan OneScan is a BurpSuite extension written in Java for recursive directory scanning, helping discover hidden vulnerabilities in deeper direct… | 10 | 1247 | abandoned |
page 1 / 1