danielmiessler / SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
maurosoria / dirsearch
Web path scanner
google / oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
foundry-rs / foundry
Foundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.
HypothesisWorks / hypothesis
The property-based testing library for Python
AFLplusplus / AFLplusplus
AFL++ is a state-of-the-art fuzzer, and #1 in benchmarks. It was originally based on AFL. Today it comes with qemu 5.1, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
google / syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
google / clusterfuzz
Scalable fuzzing infrastructure.
dubzzz / fast-check
Property based testing framework for JavaScript (like QuickCheck) written in TypeScript
schemathesis / schemathesis
Catch API bugs before your users do
google / honggfuzz
Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
six2dez / OneListForAll
Rockyou for web fuzzing
wcventure / FuzzingPaper
Recent Fuzzing Paper
AFLplusplus / LibAFL
Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
jtpereyda / boofuzz
A fork and successor of the Sulley Fuzzing Framework
msoedov / agentic_security
Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪
rust-fuzz / afl.rs
🐇 Fuzzing Rust code with American Fuzzy Lop
sqlancer / sqlancer
Automated testing to find logic and performance bugs in database systems
marin-m / pbtk
A toolset for reverse engineering and fuzzing Protobuf-based apps
scadastrangelove / awesome-ai-security-tools
A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
microsoft / coyote
Coyote is a library and tool for testing concurrent C# code and deterministically reproducing bugs.
Dropnation / contract-fuzzer
Ethereum smart contract fuzzer
pschanely / CrossHair
An analysis tool for Python that blurs the line between testing and type systems.
pashov / skills
Pashov Audit Group Skills
CodeIntelligenceTesting / jazzer
Coverage-guided, in-process fuzzing for the JVM
tandasat / Hypervisor-101-in-Rust
The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD processors.
reversenseorg / dexcalibur
Reversense (Dexcalibur2) is a fully rewriting and rethinking of Dexcalibur. Reversense is a binary intelligence platform that automates the reverse engineering of mobile and embedded applications.
stanislav-web / OpenDoor
OWASP Web Recon & Directory Discovery Platform
WebFuzzing / EvoMaster
The first open-source AI-driven tool for automatically generating system-level test cases (also known as fuzzing) for web/enterprise applications. Currently targeting whitebox and blackbox testing of Web APIs, like REST, GraphQL and RPC (e.g., gRPC and Thrift).
google / libprotobuf-mutator
Library for structured fuzzing with protobuffers
strongcourage / awesome-directed-fuzzing
A curated list of awesome directed fuzzing research papers
anmolksachan / TheTimeMachine
Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not
0sec-labs / 0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
assetnote / h3fuzz
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
Blackfrost-AI / Cyber-Frost-Harness
Native red, blue, and purple security-agent harness for CYBER-FROST
glask1d / WebHawk
The WebHawk Framework is a tool used for authorized enumeration and exploitation of webservers.
Ed-Marcavage / awesome-security-agent-harnesses
AI agents for pentesting, code audit, fuzzing, vulnerability discovery, and reverse engineering: harnesses, sandboxes, security MCP servers, benchmarks, and evals.
Krishita17 / PhantomTap
A Flipper Zero that stops guessing and starts reasoning: ML-guided RFID/NFC fuzzing & access-control auditing that turns raw card reads into a prioritized, explainable security assessment. Defensive-use only.
aftermathlabs / discord-crasher
Some bugs found via binary instrumentation and fuzzing