Fuzzing Tutorials & Security Research
In-depth guides on coverage-guided fuzzing, AFL++, libFuzzer, and integrating security testing into modern development workflows.
Triaging a False Positive — When the Fuzzer Lies
Not every crash is a bug. Allocator quirks, OOM kills, and harness state leaks all look like crashes in the dashboard. How to tell them apart and stay sane.
Read articleWhen to Reach for Structure-Aware Fuzzing
Random-byte fuzzing stalls on highly-structured inputs like PDF, X.509, and ELF. When grammar-based and protocol-aware fuzzing win — and when they do not.
Read articleFuzzing Protocol Buffers — Why Structure-Aware Beats Random Bytes
Random bytes hit the validity check and bounce. Use libprotobuf-mutator and a .proto schema to reach the message-handling code that actually contains the bugs.
Read articleReading a Coverage Report — What Branch and Edge Coverage Actually Mean
How to read an LCOV / afl-cov / source-based coverage report. Line vs branch vs edge, hot paths, dead code, and what counts as actionable signal.
Read articleAFL++ Persistent Mode — Patterns That Actually Speed Up Your Fuzzing
Persistent mode is the difference between 100 execs/sec and 100,000. Anti-patterns, the LLVM mode requirements, state-reset tricks, and when fork mode wins.
Read articleFuzzing a Rust Crate End-to-End with cargo-fuzz
A complete walkthrough: install cargo-fuzz, write a fuzz target against a real Rust crate, run it, triage a crash, minimise the reproducer, ship a fix.
Read articleAFL++ vs Honggfuzz — When to Pick Each
AFL++ and Honggfuzz are both production-grade fuzzers. They optimise for different things. Architecture, mutators, persistent mode, and how to choose.
Read articleReading ASan, UBSan, and MSan Crash Reports — A Field Guide
How to decode AddressSanitizer, UndefinedBehaviorSanitizer, and MemorySanitizer crash reports from a fuzzer. Stack traces, shadow memory, false positives.
Read articleYour First Fuzz Job on Fuzze.rs: From Zero to a Real Crash
Submit your first fuzzing job on Fuzze.rs: a tiny deliberately-buggy target, a six-line Dockerfile, and a short JSON config — explained line by line.
Read articleHow to Add Continuous Fuzzing to Your CI/CD Pipeline
How to wire AFL++ and libFuzzer into GitHub Actions, GitLab CI, and other CI/CD pipelines — with real configuration examples you can copy and run.
Read articlelibFuzzer vs AFL++: Choosing the Right Fuzzer for Your Project
libFuzzer vs AFL++: how the two leading coverage-guided fuzzers differ in architecture, speed, ease of use, and which to pick for your target.
Read articleAFL++ Tutorial: Getting Started with Coverage-Guided Fuzzing
A hands-on AFL++ guide: instrument your target, build a starter corpus, tune for executions-per-second, and triage the first crashes that land.
Read articleWhat Is Fuzz Testing? A Developer's Guide to Finding Hidden Bugs
Fuzz testing generates millions of random inputs to find crashes and security bugs your unit tests miss. Here's how it works and when to use it.
Read articleGet new posts in your inbox
A short weekly email with the latest fuzzing tutorials and research. No spam, one-click unsubscribe.