boofuzz

Protocol fuzzing automates the discovery of security and robustness issues in network protocols by systematically mutating inputs and monitoring for crashes. Boofuzz provides a framework to define protocol structures using primitives like Request and Block, then automatically generates and sends malformed packets to detect failures without manual trial-and-error.

Yes. Boofuzz supports defining custom binary protocols through its Request, Block, and Primitive components, allowing you to model headers, PDUs, and stateful sessions. You specify length and endianness constraints, then the framework generates mutation-based test cases tailored to your protocol structure.

Boofuzz integrates crash detection by monitoring target responses during fuzzing runs. You configure callbacks to capture failures, then the framework summarizes findings and produces reproducible test cases and logs for triage, enabling you to quickly identify which inputs triggered issues.

Mutation-based fuzzing with Boofuzz systematically tests protocol implementations by varying packet structures and observing target behavior. Define your protocol PDUs with correct and invalid variants, run the fuzzer against the target, and collect crash reports to expose implementation weaknesses in protocols like iSCSI and MQTT.

Boofuzz supports optional pre- and post-test callbacks to manage session state and validate responses. While basic fuzzing works without them, callbacks let you maintain connection state, handle handshakes, and verify target behavior across stateful protocol exchanges for more comprehensive testing.

Yes. Boofuzz's Request and Block primitives create reusable protocol components that you define once and apply across different fuzzing runs and targets. This modularity eliminates redundant protocol modeling and enables consistent, reproducible test cases for similar protocol variants.