Fuzzing (fuzz testing) is an automated software testing technique that discovers vulnerabilities by feeding programs unexpected, random, or malformed input data and monitoring for crashes, hangs, memory corruption, and unexpected behavior. Fuzzing excels at finding implementation bugs -- buffer overflows, format string vulnerabilities, integer overflows, and parsing errors -- that manual code review and traditional testing frequently miss.
Fuzzing operates through three primary approaches. Mutation-based (dumb) fuzzing takes valid input samples and randomly modifies bytes, flips bits, inserts special values, and truncates or extends data to generate test cases. Generation-based (smart) fuzzing uses knowledge of input format specifications to produce structurally valid inputs with fuzzed values in specific fields, providing better code coverage by passing initial parsing checks. Coverage-guided fuzzing (used by tools like AFL, libFuzzer, and Honggfuzz) instruments the target program to track code coverage, then uses evolutionary algorithms to mutate inputs that discover new code paths -- progressively exploring deeper program logic. The fuzzing harness wraps the target function, feeds it generated inputs, and monitors for signals indicating vulnerabilities: crashes (segfaults, assertion failures), sanitizer violations (AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer), timeouts indicating infinite loops, and differential behavior between implementations. Modern fuzzing integrates into CI/CD pipelines through services like OSS-Fuzz, continuously testing code changes against evolving input corpora.
Fuzzing has discovered thousands of critical vulnerabilities in widely used software including browsers, operating system kernels, network protocol implementations, and media parsers. Google's OSS-Fuzz project has found over 40,000 bugs in open-source software. Fuzzing is particularly effective against C/C++ programs where memory corruption vulnerabilities have severe security implications, but modern fuzzers also target APIs, protocol implementations, and data parsers in any language.
CDA integrates fuzzing into VSD assessment methodologies. Theater missions deploy coverage-guided fuzzers against custom application parsers, network protocol handlers, and file processing components, finding implementation vulnerabilities that static analysis and manual testing overlook.