A security-oriented, feedback-driven, evolutionary software fuzzer that uses hardware and software code coverage to find bugs.
Honggfuzz is a security-oriented software fuzzer that automatically generates malformed or unexpected inputs to test programs for crashes, memory corruption, and other vulnerabilities. It uses evolutionary, feedback-driven techniques based on hardware and software code coverage to efficiently explore code paths and discover bugs. The tool is designed for fuzzing a wide range of software, from web servers and cryptographic libraries to interpreters and media parsers.
Security researchers, software developers, and quality assurance engineers who need to perform rigorous security testing on native code, especially those working on critical infrastructure, open-source projects, or embedded systems.
Developers choose Honggfuzz for its high performance, support for persistent fuzzing, and ability to leverage hardware-based code coverage for deeper bug discovery. Its ease of use, multi-platform support, and proven track record in finding major vulnerabilities in projects like OpenSSL and Apache make it a trusted tool in the fuzzing ecosystem.
Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Multi-process and multi-threaded design with persistent fuzzing enables iteration speeds up to 1 million per second, as highlighted in the README for direct API testing.
Has uncovered critical CVEs in major projects like OpenSSL (CVE-2016-6309) and Apache, demonstrating real-world effectiveness in security hardening.
Can start fuzzing with an empty input corpus and automatically generate valid test cases, reducing initial setup complexity for new users.
Uses low-level APIs like ptrace to detect hijacked signals and hidden crashes, catching subtle memory corruption that other fuzzers might miss.
Requires clang and specific compiler wrappers (hfuzz-clang) for instrumentation, which can complicate integration with projects using GCC or other toolchains.
Primarily optimized for C/C++; fuzzing interpreted languages like Python or Ruby requires targeting the interpreter directly, not leveraging all features efficiently.
Full benefits of hardware-based code coverage depend on Intel BTS/PT, limiting effectiveness on older CPUs, ARM systems, or virtualized environments.