a hash for a crashing input to determine its uniqueness and then assigns an exploitability rating: Exploitable Probably Exploitable Probably Not Exploitable, or Unknown. Previously unreported, triaged bugs might be automatically reported to a bug tracking system. For instance, OSS-Fuzz runs large-scale, long-running fuzzing campaigns for several security-critical software projects where each previously unreported, distinct bug is reported directly to a bug tracker. The OSS-Fuzz bug tracker automatically informs the maintainer of the vulnerable software and checks in regular intervals whether the bug has been fixed in the most recent revision using the uploaded minimized failure-inducing input. Automated input minimization Automated input minimization (or test case reduction) is an automated debugging technique to isolate that part of the failure-inducing input that is actually inducing the failure. If the failure-inducing input is large and mostly malformed, it might be difficult for a developer to understand what exactly is causing the bug. Given the failure-inducing input, an automated minimization tool would remove as many input bytes as possible while still reproducing the original bug. For instance, Delta Debugging is an automated input minimization technique that employs an extended binary search algorithm to find such a minimal input. List of popular fuzzers The following is a list of fuzzers described as "popular", "widely used", or similar in the academic literature. See also American fuzzy lop (fuzzer) Concolic testing Glitch Glitching Monkey testing Random testing Responsible disclosure Runtime error detection Security testing Smoke testing (software) Symbolic execution System testing Test automation References Further reading A free, online, introductory textbook on fuzzing. Ari Takanen, Jared D. DeMott, Charles Miller, Fuzzing for Software Security Testing and Quality Assurance, 2008, Michael Sutton, Adam Greene, and Pedram Amini. Fuzzing: Brute Force Vulnerability Discovery, 2007, . H. Pohl, Cost-Effective Identification of Zero-Day Vulnerabilities with the Aid of Threat Modeling and Fuzzing, 2011 Fabien Duchene, Detection of Web Vulnerabilities via Model Inference assisted Evolutionary Fuzzing, 2014, PhD Thesis Bratus, S., Darley, T., Locasto, M., Patterson, M.L., Shapiro, R.B., Shubina, A., Beyond Planted Bugs in "Trusting Trust": The Input-Processing Frontier, IEEE Security & Privacy Vol 12, Issue 1, (Jan-Feb 2014), pp. 83–87—Basically highlights why fuzzing works so well: because the input is the controlling program of the interpreter. External links Fuzzing Project, includes tutorials, a list of security-critical open-source projects, and other resources. University of Wisconsin Fuzz Testing (the original fuzz project) Source of papers and fuzz software. Designing Inputs That