address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.
fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
harness-writing — Designs and improves fuzzing harnesses for C/C++ and Rust.
libafl — Builds custom fuzzers with LibAFL, the modular Rust fuzzing library.
libfuzzer — Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.
ossfuzz — Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally.
ruzzy — Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language.
testing-handbook-generator — md files with the structure each skill type requires. guide. Not for answering security testing questions — the generated skills cover those.
wycheproof — Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH.