secfigo/awesome-fuzzing

Awesome Fuzzing is a curated reading and resource list for people who want to learn about fuzzing. Fuzzing is a software testing method where a program is fed large amounts of unexpected, random, or malformed input to see if it crashes or behaves incorrectly. Finding those failures reveals security vulnerabilities and bugs that more traditional testing often misses. The list also covers the early stages of exploit development, particularly root cause analysis, which is the process of understanding why a crash happened. The list is organized into several sections. Books come first, covering titles specifically dedicated to fuzzing as well as chapters from broader security books that touch on the topic. Next are courses, split between free options (such as academic lecture series from NYU Poly and Florida State University) and paid training programs from organizations including Offensive Security and SANS. A videos section follows, pulling from conference talks, university lectures, and curated YouTube playlists. The tutorials and blog posts section points to write-ups that explain fuzzing techniques through specific case studies, including examples of fuzzing the Windows kernel, web browsers, PDF viewers, and image parsers. The tools section is grouped by fuzzing type: cloud fuzzers, file format fuzzers, network protocol fuzzers, browser fuzzers, taint analysis tools, and symbolic execution engines, along with essential debugging and disassembly tools commonly used alongside fuzzing. Two additional sections address narrower topics. Vulnerable applications lists intentionally insecure programs that beginners can target to practice without causing real-world harm. Anti-Fuzzing covers techniques that software vendors use to make fuzzing harder, which matters to security researchers studying hardened targets. A directed fuzzing section points to resources on techniques that guide the fuzzer toward specific code paths rather than exploring purely at random. The repository itself contains no code. It is a Markdown file of links, maintained as a community reference.