Tools

The actively maintained, heavily extended fork of American Fuzzy Lop — coverage-guided mutational fuzzing for finding crashes in binaries and libraries.

afl-fuzz -i in -o out -- ./target @@

Finds hidden HTTP GET/POST parameters on a web endpoint by bruteforcing against a large parameter-name wordlist — the step before you know what to actually inject into.

arjun -u https://target.tld/api/endpoint

Protocol-aware fuzzing framework (fork/successor of Sulley) for building fuzzers against network services and file formats with defined message structures.

A web content scanner that looks for existing (and hidden) objects by bruteforcing a wordlist against a target — one of the original tools in this space, still bundled in Kali.

dirb http://target/ /usr/share/wordlists/dirb/common.txt

Python framework (with GoodFET/GreatFET/Cynthion hardware backends) for emulating arbitrary USB devices in software, used to fuzz host USB stacks/drivers or spoof a device a host expects.

A fast, recursive content-discovery tool written in Rust — automatically dives into discovered directories without needing to be re-run manually, unlike gobuster/dirb.

feroxbuster -u https://target.tld -w wordlist.txt -x php,html,txt

A fast web fuzzer written in Go — content discovery, virtual-host fuzzing and parameter fuzzing, all through one flexible FUZZ-keyword syntax.

ffuf -u http://target/FUZZ -w wordlist.txt -mc all -fc 404

Dictionaries of attack payloads and predictable filenames/paths for discovery and fuzzing (injection strings, common backup/config filenames, error-message patterns), maintained separately from SecLists.

A fast Go-based bruteforcer for directories/files, DNS subdomains, virtual hosts and S3 buckets — the everyday content-discovery default for a lot of testers.

gobuster dir -u http://target -w wordlist.txt -x php,txt,bak

Google's security-oriented fuzzer that can drive coverage from hardware performance counters as well as compile-time instrumentation, useful when source is unavailable.

honggfuzz -i in -o out -- ./target ___FILE___

In-process, coverage-guided fuzzing engine linked directly into an LLVM/Clang target — the standard way to fuzz a single function without forking a process per input.

clang -fsanitize=fuzzer,address target.c -o fuzz && ./fuzz

PortSwigger's Burp Suite extension for finding hidden, unlinked parameters and headers — including the ones that unlock web-cache-poisoning bugs.

General-purpose test-case mutator that takes sample inputs and spits out mutated variants — a quick way to build a crude fuzzing corpus for a CTF parser challenge.

radamsa -n 1000 -o out-%n.bin sample.bin

The single most-used wordlist collection in the field — usernames, passwords, URLs, fuzzing payloads and more, curated and maintained, and bundled by default in Kali.

Coverage-guided kernel fuzzer built by Google, used to find Linux/Windows/macOS kernel bugs that CTF kernel-pwn challenges are frequently modelled on.

High-throughput HTTP request engine (Python-scripted) built for large brute-force jobs and race-condition testing that would be too slow through a regular intercepting proxy.

GUI workbench for reverse-engineering unknown radio protocols — demodulate, decode and re-encode signals, then fuzz them, without writing GNU Radio flowgraphs by hand.

Google Project Zero's fork of AFL targeting Windows binaries, using DynamoRIO instrumentation to fuzz closed-source Windows executables and DLLs.

A cross-site scripting detection suite that fuzzes parameters with a context-aware payload generator, rather than firing a static payload list at everything.

python3 xsstrike.py -u "https://target.tld/search?q=test"

Transparent input fuzzer that randomly flips bits in a program's input stream via LD_PRELOAD, a quick way to probe robustness without instrumenting the target.

zzuf -s 0:100 ./parser input.bin