I have been looking for guides and tutorials about how to fuzz and so far everything I have seen has been for web servers. If I wanted to fuzz something along the lines of calc.exe or a program that echoed back arguments passed to it. What framework should I use and how should I go about it. I am looking for help fuzzing an application which receives 0 network traffic and receives input via dialog boxes or command line arguments.

4 Answers 4


Updated answer: If you are using Windows, try the CERT Failure Observation Engine (FOE). It is a fuzzing framework for Windows. It has the ability to do file-based fuzzing, to click on dialog boxes, and other stuff.

Previous answer: I suggest you start with zzuf. It is the simplest, easiest to use command-line fuzzer for fuzzing standalone programs that read their input from files, stdin, or the command line. It is extremely easy to use, and a good starting point.

You could also look at the CERT Basic Fuzzing Framework.

Then if you want to get more sophisticated you can look at other fuzzers (Spike, etc.), but that'll get you started.

If you want to fuzz programs that receive input via dialog boxes, sorry, I don't know what to recommend.


You should definitely try american fuzzy lop. It's a fuzzer that operates on standard input of the application (or a file passed via the command line arguments) and feeds the program with random data. Then it watches for code paths that were triggered by it and intelligently chooses new test cases to maximize test coverage. It already found hundreds of open source bugs.

  • Why the downvote?
    – d33tah
    Commented Oct 14, 2015 at 10:56
  • 1
    +1, AFL is one of the best fuzzers out there.
    – gsgx
    Commented Dec 9, 2015 at 11:53

You can fuzz GUI using Peach Fuzzing Framework (http://peachfuzzer.com)

Here is an article about it: http://phed.org/2008/01/13/peach-21-fuzzing-gui-applications/


if you want to Fuzz Web Applications there is powerful and easy-to-us fuzzing in acunetix web application security scanner and OWASP Fuzzing projects like JBroFuzz , etc. Also your welcome to use fuzzer frameworks such as and not limited to Peach ( you must have a skills for peach pit XML building, plus there is not enough document for it, of curse). SPIKE and other utility are available in Kali Linux or Backtrack and penetration testing Linux distribution, Finally if you have a skills in programming ( C, Python, ...) you can build your own special Fuuzer, too

Good luck

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .