Fuzz Testing

Automated software testing that generates many semi-random inputs to find crashes, hangs, and security vulnerabilities.

Fuzz testing (or fuzzing) is an automated testing technique that feeds a program a large volume of generated inputs in search of crashes, hangs, and incorrect outputs. Modern fuzzers — AFL++, libFuzzer, Honggfuzz, Centipede — combine input mutation with execution-time feedback (typically branch-coverage instrumentation) to evolve inputs that progressively exercise new code paths. The technique scales: a corpus of crashes that would take a human auditor months to find can surface in hours of fuzzing. Fuzzing is most effective against parsers, codecs, protocol implementations, and any code that processes attacker-controllable byte strings. It is complementary to, not a replacement for, unit testing and static analysis.