What Is Fuzzing?
Fuzzing is an automated testing technique that bombards a program with malformed, unexpected, and random inputs to see what breaks. Each crash or hang is a signpost pointing at a bug — frequently a serious memory-safety flaw. Because machines can try millions of weird inputs a human never would, fuzzing finds the edge cases that hide in real software.
How does fuzzing work?#
A fuzzer runs a target repeatedly, mutating its input each time and watching for abnormal behavior:
- Start with seed inputs (valid examples).
- Mutate them — flip bits, insert junk, exceed limits.
- Feed each variant to the program.
- Watch for crashes, hangs, memory errors, or assertions.
- Save the inputs that trigger new behavior and mutate further.
Modern coverage-guided fuzzers (AFL, libFuzzer) instrument the code to see which paths an input reaches, then favor inputs that explore new ground — turning blind fuzzing into a guided search that reaches deep bugs quickly.
Why does fuzzing find what humans miss?#
Because people test what they expect; fuzzers test what they do not. A developer validates the happy path and a few obvious errors. A fuzzer cheerfully sends a two-gigabyte filename, a negative length, and a string of null bytes — exactly the malformed input that triggers buffer overflows and parsing bugs.
| Finds well | Finds poorly |
|---|---|
| Memory-safety crashes | Business-logic flaws |
| Parser and format bugs | Access-control errors |
| Unhandled edge cases | Anything needing valid auth/state |
Fuzzing is a core vulnerability-research method, complementary to input validation on the defensive side. More at the Security Fundamentals hub.
Frequently asked questions#
What is fuzzing in security testing?
Fuzzing is an automated technique that feeds a program large volumes of malformed, unexpected, or random input to trigger crashes, hangs, or other faulty behavior. Each crash points to a bug — often a memory-safety flaw — that a human tester would be unlikely to reach by hand. It excels at finding edge cases.
What is coverage-guided fuzzing?
Coverage-guided fuzzers, like AFL and libFuzzer, watch which code paths each input exercises and evolve inputs that reach new paths. Instead of blind randomness, they steer toward unexplored code, finding deep bugs far faster. This feedback loop is why modern fuzzing is so effective at scale.