#fuzzing
Wiki 8
- appsec.guide — Fuzzing Chapter (Trail of Bits Testing Handbook) Trail of Bits' Testing Handbook fuzzing chapter — terminology, the mutation-based evolutionary algorithm, fuzzer components, and a taxonomy of bug classes; entry point to language-specific subsections
- Coverage-Guided Fuzzing The dominant modern fuzzing algorithm — evolutionary loop over a corpus of test cases, fitness measured by code coverage, mutated offspring kept when they reach new coverage
- Differential Fuzzing Run the same input through two implementations of the same spec and treat disagreement as a bug; finds spec-conformance issues neither implementation would catch alone
- gosentry — Trail of Bits' Go Fuzzing Fork Kevin Valerio (Trail of Bits) introduces gosentry, a Go toolchain fork that wraps the standard testing.F API around a LibAFL+Nautilus engine for grammar, struct, race, leak, and overflow detection
- Grammar-Based Fuzzing Generate fuzzing inputs from a context-free grammar instead of random bytes, so inputs survive early parsing stages and exercise downstream logic
- LibAFL Rust framework for building coverage-guided fuzzers — composable stages, mutators, observers, and feedbacks instead of a fixed loop; descendant of AFL++ research
- Nautilus Grammar-based coverage-guided fuzzer; uses tree mutations on context-free grammars to produce structurally valid inputs that survive front-end parsing
- Structure-Aware Fuzzing Fuzz a function by generating valid in-language values (structs, slices, pointers) instead of raw bytes; the fuzzer mutates bytes underneath and the runtime handles encode/decode
Toolbox 1
- gosentry Fork of the Go toolchain that runs standard testing.F fuzz harnesses through a LibAFL+Nautilus engine — struct-aware, grammar-aware, race/leak/overflow detection