fuzzdb-project/fuzzdb resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

8980 stars · 2104 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

FuzzDB is a comprehensive open-source dictionary of attack payloads, predictable resource locations, and regex patterns for black-box application fault injection and resource discovery. It functions as a dataset of security testing primitives rather than a tool, designed to be used with scanners and proxies like Burp Intruder and OWASP ZAP.

Use cases

• fuzz web applications for sql injection and xss payloads
• discover hidden admin directories and log files on a web server
• find authentication bypass patterns during a pentest
• match server error responses with regex to detect vulnerabilities
• get wordlists for brute-forcing parameters and resources
• test file upload bypass and os command injection

When to choose

• you need a comprehensive, categorized dictionary of attack payloads for dynamic application security testing
• you use Burp Suite, OWASP ZAP, or a fuzzer that accepts custom payload lists
• you want predictable file path dictionaries sorted by platform and language

When to avoid

• you need an automated scanner that runs tests for you rather than payload dictionaries
• you need a maintained tool with an active license and release process
• you are doing static source code analysis instead of black-box testing

Facets

dataset · maturity maintenance

penetration-testing security vulnerability-scanning security penetration-testing web-development cross-platform fuzzing wordlists attack-payloads black-box-testing dast burp-suite owasp

Member repositories

For agents

markdown · JSON · MCP: product_card(name="fuzzdb-project/fuzzdb")