Open-source alternatives to Fuzzing

OSS-Fuzz is a distributed, containerized platform for continuous fuzzing and memory safety analysis. It functions as a bug hunting infrastructure that identifies security vulnerabilities and stability bugs through automated, coverage-guided fuzz testing across a scalable cluster of containers. The system provides a continuous security testing pipeline that manages the entire lifecycle of vulnerability discovery, from bootstrapping project templates and compiling targets to executing long-running batch tests. It specifically focuses on memory safety, utilizing sanitizers to detect buffer overf

AFL is a coverage-guided fuzzer and security vulnerability scanner used to identify software bugs and memory corruption by feeding programs mutated data. It functions as a binary instrumentation tool and a test case minimizer to locate crashes and isolate the smallest set of bytes causing a fault. The project distinguishes itself through its ability to operate as a parallel fuzzing orchestrator, distributing workloads across multiple CPU cores or networked machines. It utilizes dictionary-based mutation for complex file formats and performs input sensitivity analysis to identify critical sect

This project is a suite of runtime diagnostic tools designed to detect memory leaks, concurrency races, and language-specification violations during software execution. It provides a collection of dynamic analysis tools that identify addressability issues, uninitialized memory usage, and memory safety bugs in applications. The toolset includes a thread safety analyzer to identify data races and deadlocks in concurrent code, as well as an undefined behavior sanitizer to detect operations that violate language specifications. The system covers broad capabilities in memory safety monitoring and

Syzkaller is an unsupervised, coverage-guided kernel fuzzer that automatically generates and mutates system call sequences to find bugs in operating system kernels. It operates without human intervention, using a closed feedback loop of input generation, execution, crash detection, and corpus refinement to continuously explore kernel code paths. The fuzzer distinguishes itself by supporting multiple operating system kernels, including Linux, FreeBSD, and Windows, through per-platform syscall harnesses that abstract system call interfaces behind a common driver. It uses declarative description

This project is a comprehensive educational resource and programming course covering C++ language semantics and features from C++03 through C++26. It provides structured tutorials and technical guides focused on modern C++ development. The material offers specialized instruction on template metaprogramming, including the use of type traits and compile-time computations. It features detailed guides on concurrency and parallelism for multi-core execution, as well as a reference for software design applying SOLID principles and RAII. Additionally, it covers build performance optimization to redu

Fuzzing101 is an educational resource providing a structured curriculum and containerized security labs for learning software fuzzing and vulnerability research. It functions as a training course that guides users through the process of identifying security flaws using systematic input manipulation and memory corruption analysis. The project distinguishes itself by providing isolated environments that ensure consistent build dependencies for practicing software instrumentation and crash triaging. It includes a practical tutorial on using evolutionary fuzzing engines and instrumentation tools

fast-check is a property-based testing framework and random data generator designed to verify software invariants by producing a wide range of randomized input data. It functions as a test data fuzzer that executes predicates against high volumes of random inputs to uncover edge cases and critical bugs. The project is distinguished by its ability to perform input-shrinking searches, which reduce complex failing inputs to their simplest form to isolate the exact cause of failure. It provides deterministic seed replay to exactly reproduce specific test failures and includes a concurrency testin

Schemathesis is a property-based testing tool and fuzzer for schema-based APIs. It analyzes OpenAPI and JSON Schema specifications to automatically generate test cases that identify crashes, schema violations, and validation bypasses. The project functions as a contract validator and security scanner, verifying that a live server strictly adheres to its defined specifications. The framework distinguishes itself through stateful API testing, which chains multiple related requests together to uncover bugs that only emerge during complex, multi-step user workflows. It also utilizes response-driv

c3c is the compiler for the C3 programming language, transforming source code into executable binaries, static libraries, or dynamic libraries using an LLVM backend. It implements a system based on result-based error handling, scoped memory pooling, and a semantic macro system. The compiler provides first-class support for hardware-backed SIMD vectors that map directly to processor instructions and enables runtime polymorphism through interface-based dynamic dispatch. The project covers a broad set of low-level capabilities, including manual and pooled memory management, inline assembly inte

TUnit is a comprehensive C# testing framework, mocking library, and fluent assertion tool. It utilizes source generation for test discovery and mock creation, ensuring compatibility with Native AOT and IL trimming by eliminating the need for runtime reflection and proxies. The framework provides specialized capabilities for integration testing, including the management of distributed application lifecycles, isolated database schemas, and the correlation of telemetry and logs across process boundaries via OTLP. It also includes an HTTP testing utility to intercept network exchanges and mock AP

This project provides a framework for managing multi-agent systems, designed to automate complex software development, infrastructure, and business workflows. It functions as a multi-agent workflow orchestrator that routes tasks to domain-specific workers while maintaining state persistence and infrastructure automation. By leveraging large language models, the system decomposes high-level objectives into actionable plans, ensuring that complex operations are executed with consistency and reliability. The framework distinguishes itself through its hierarchical agent registry and policy-driven

This project is a structured Rust programming curriculum and systems programming course designed to take learners from beginner to expert levels. It provides a comprehensive set of training materials focused on mastering the core syntax, idioms, and technical foundations of the Rust language. The project features a specialized language transition framework that maps concepts from C++, managed languages, and dynamic typing to Rust idioms. This allows developers from different ecosystems to translate architectural patterns and memory models into idiomatic Rust. The training covers a broad rang

oneAPI Threading Building Blocks (oneTBB)

Infer is a static analysis toolset for Java, C, C++, and Objective-C designed to detect memory leaks, null dereferences, and resource bugs. It functions as a multi-language bug finder that identifies race conditions, deadlocks, and memory safety issues by translating source code into a common intermediate representation for analysis. The project distinguishes itself through an inter-procedural data flow analyzer that tracks movement between sources and sinks to detect tainted flows and generate data flow graphs. It also includes a framework for verifying temporal properties and reachability u

Hypothesis is a property-based testing library for Python that automatically generates randomized input data to identify bugs and edge cases. It functions as an automated edge case finder and test data generator, creating diverse synthetic datasets based on defined strategies to stress test application logic. The library includes a failing case shrinker that simplifies complex failing test inputs into the smallest possible examples to accelerate debugging. It also provides a mechanism for bug reproduction simplification by reducing the size of the input that triggers a failure. The project c

xHook is a low-level instrumenter and hooking library for Android ELF binaries. It functions as a framework for intercepting native symbols and redirecting function calls by modifying the procedure linkage table. The tool utilizes regular expressions to filter specific binary files and symbols for interception. It enables the redirection of native calls toward custom function implementations without altering the original binary files. The framework covers dynamic symbol resolution, ELF table modification, and security analysis of native libraries. It also includes stability mechanisms that u

This project is a Linux server security guide and system administration manual designed to harden the operating system and kernel. It functions as an OS hardening checklist and a collection of instructions for reducing the server attack surface to protect against intruders. The guide covers the establishment of a server security baseline and the reduction of the network attack surface. It provides practical guidance for managing system permissions and network configurations to maintain a secure environment. The content is organized as a series of step-by-step procedural layouts and topic-cat

Luau is a high-performance programming language evolved from Lua 5.1. It consists of a bytecode virtual machine, an embeddable scripting engine, and a static code analyzer designed to provide a secure, sandboxed execution environment for host applications. The project is distinguished by its gradual typing system, which combines automatic type inference with optional manual annotations to detect bugs without requiring full static typing. It also features native vector mathematics for high-performance operations and a specialized debugging system that uses bytecode patching to minimize executi

This project is a comprehensive security hardening and privacy management guide for macOS. It provides a set of instructions and checklists for reducing the system attack surface through manual configuration, policy enforcement, and a layered defense strategy. The guide emphasizes a system auditing framework, using binary analysis, system logs, and packet inspection to verify that security controls and application sandboxing are functioning as intended. It offers tool-agnostic recommendations, defining security goals while allowing users to select their own third-party software for implementa

This project is a framework for the autonomous discovery and remediation of security vulnerabilities using large language model agents. It functions as a security research pipeline that automates the process of reconnaissance, crash discovery, and exploitability analysis to identify reproducible software bugs. The system distinguishes itself by utilizing a containerized agent sandbox that restricts network egress and filesystem access to prevent host compromise. It employs a specialized patch generation and validation loop, which includes adversarial re-attack testing where a fresh agent atte

WeChatOpenDevTools-Python is a set of software utilities designed to bypass environment restrictions to enable debugging and element inspection for web and mini program applications. It functions as a developer tool unlocker and web inspector activator to force the activation of integrated inspection tools. The project provides specialized capabilities for debugging and reverse engineering WeChat mini programs. This includes the ability to access hidden developer consoles to analyze the structure, network requests, and behavior of active mini programs and web content. These utilities utilize

Panicparse is a toolset for Go crash analysis and runtime debugging. It functions as a panic stack trace parser, a race detector log parser, and a goroutine deduplicator designed to transform raw crash dumps and thread sanitizer output into structured, readable formats. The project distinguishes itself by converting complex stack traces into visual HTML reports with embedded source code. It reduces noise in highly parallelized processes by grouping identical goroutine stacks and prioritizes application code over standard library calls during parsing. The utility also covers live process moni

This project is a security hardening guide and privacy configuration manual for macOS. It provides a comprehensive set of instructions for configuring system settings to improve privacy, reduce the attack surface, and implement a malware defense framework. The guide covers technical methods for validating software notarization, verifying application sandboxing, and auditing system activity. It distinguishes itself by providing detailed workflows for restricting high-risk features and applying advanced security configurations to protect the operating system. The documentation covers several k

This project provides a collection of official base images for building and running .NET applications across various operating systems and hardware architectures. It includes standardized runtime environments, containerized development kits, and specialized images designed for isolated application execution. The collection is distinguished by its focus on image optimization and security hardening. It offers distroless images that remove shells and package managers to reduce the attack surface, as well as composite layering and ahead-of-time compilation to improve startup performance and lower

Fishhook is a binary instrumentation library for iOS and iOS simulators. It functions as a Mach-O symbol rebinder and instrumenter, allowing for the replacement of system library implementations with custom logic at runtime. The project redirects function calls by updating lazy and non-lazy symbol pointers within Mach-O binary data segments. This approach enables the interception and modification of existing function behavior without altering the original binary on disk. The toolset covers binary instrumentation and dynamic hooking for iOS applications, facilitating the monitoring and altera

Shellharden is a shell script hardening tool and linter designed to improve the security and reliability of Bash scripts. It functions as an automated utility that rewrites scripts to follow industry standards for quoting and security practices. The project provides an optimizer and standardizer that replaces unsafe patterns and aliases with safer functional equivalents. It includes a syntax highlighter that uses visual markers and colorization to indicate vulnerabilities and areas where quoting corrections are required. The tool covers a broad range of capabilities including automated safet