Top 8 Go Fuzzing Projects

syzkaller

7 5,124 0.0 Go

syzkaller is an unsupervised coverage-guided kernel fuzzer

Project mention: Automated Unit Test Improvement Using Large Language Models at Meta | news.ycombinator.com | 2024-02-17

https://arxiv.org/abs/2402.09171 :
> This paper describes Meta's TestGen-LLM tool, which uses LLMs to automatically improve existing human-written tests. TestGen-LLM verifies that its generated test classes successfully clear a set of filters that assure measurable improvement over the original test suite, thereby eliminating problems due to LLM hallucination. [...] We believe this is the first report on industrial scale deployment of LLM-generated code backed by such assurances of code improvement.
Coverage-guided unit test improvement might [with LLMs] be efficient too.
https://github.com/topics/coverage-guided-fuzzing :
- e.g. Google/syzkaller is a coverage-guided syscall fuzzer: https://github.com/google/syzkaller
- Gitlab CI supports coverage-guided fuzzing: https://docs.gitlab.com/ee/user/application_security/coverag...
- oss-fuzz, osv
Additional ways to improve tests:
Hypothesis and pynguin generate tests from type annotations.
There are various tools to generate type annotations for Python code;
> pytype (Google) [1], PyAnnotate (Dropbox) [2], and MonkeyType (Instagram) [3] all do dynamic / runtime PEP-484 type annotation type inference [4] to generate type annotations. https://news.ycombinator.com/item?id=39139198
icontract-hypothesis generates tests from icontract DbC Design by Contract type, value, and invariance constraints specified as precondition and postcondition @decorators:

go-fuzz

10 4,705 5.2 Go

Randomized testing for Go

Project mention: Fuzzing in Go | /r/golang | 2023-06-10

I used this method successfully for my qjson package . It accepts as input a human readable json. It detected a condition I forgot to check in a few minutes. I used the go fuzzer go-fuzz from Dmitry Vyukov. Check the impressive list of trophies at the end of the README. These are bugs found by the fuzzer.

WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
rapid

4 538 6.4 Go

Rapid is a modern Go property-based testing library

Project mention: Property based testing in Go | dev.to | 2024-03-01

You can check the package here, in official GitHub repo. I recently found this amazing testing framework and now I can't imagine developing tests without it. Let's try to refactor our previous example with this package:

firefly

1 369 6.0 Go

Black box fuzzer for web applications (by Brum3ns)
cfuzz

2 79 0.0 Go

Command line fuzzer and bruteforcer 🌪 wfuzz for command
shfz

4 63 3.9 Go

TypeScript Scenario-Based Web Application Fuzzing Framework
cnfuzz

2 36 0.0 Go

Breaking Cloud Native Web APIs in their natural habitat.
InfluxDB

www.influxdata.com sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
bruter

4 34 8.1 Go

Brutuer is an OSINT tooling, an experiment to build a reconnaissance simple app to have fun 🕵️‍♂️

Project mention: https://github.com/CyberRoute/bruter | /r/golang | 2023-11-04

- https://github.com/CyberRoute/bruter

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).