What fuzzing does is that we feed an application with a large number of malformed inputs and look for undesired behaviour, e. We usually do this by taking a valid input and add random errors to it. Promising fuzzing targets are tools that provide parsers for a large number of exotic file formats. Let's take ImageMagick as an example. Wfuzz is a tool for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforcing GET and POST parameters for different kinds of injections (SQL, XSS, LDAP, etc.), bruteforcing form parameters (user/password), fuzzing, and more. Review this tool.
Tools
Popular fuzzing tools
Fuzzapi (REST API fuzzing tool)
application fuzzing, application testing
Fuzzapi is a security tool to test a REST API using fuzzing. It can be used for security assessments and penetration tests.
Wapiti (vulnerability scanner for web applications)
application fuzzing, vulnerability scanning, web application analysis
Wapiti is typically used to audit web applications.
Wfuzz (web application fuzzer)
application fuzzing, application security, application testing, web application analysis
Wfuzz is a fuzzing tool written in Python. Tools like Wfuzz are typically used to test web applications and how they handle both expected as unexpected input.
boofuzz (fuzzing framework)
application fuzzing, vulnerability scanning
Boofuzz is a framework written in Python that allows hackers to specify protocol formats and perform fuzzing. It does the heavy lifting of the fuzzing process. It builds on its predecessor Sulley and promises to be much better. Examples include the online documentation, support to extend the tooling, easier installation, and far fewer bugs. It comes with built-in support for serial fuzzing, the ethernet and IP layers, and UDP broadcasts.
syzkaller (Linux kernel fuzzer)
application fuzzing, application testing
What Does A Fuzzing Tool Do
Syzkaller is an unsupervised coverage-guided Linux kernel fuzzer. It tests kernel system calls (syscall) to see how they respond to unexpected data.
Open Source Fuzzing Tools
Fuzzing Tools
Missing a favorite tool in this list? Share a tool suggestion and we will review it.
Related topics
Looking for more specific topics within this tool group? Have a look at the following relevant topics.