boofuzz
github.com
What it is
boofuzz is a network protocol fuzzing framework and a successor to Sulley. It installs as a Python library for building fuzzer scripts, using `pip install boofuzz`, and requires Python 3.9 or later. Its workflow generates data, detects failures, resets targets after failures, and records test data. It supports varied communications, including serial, Ethernet and IP-layer traffic, UDP broadcast, TCP, UDP, SSL, and raw sockets. Run logs are saved in a SQLite database in the boofuzz-results directory, saved runs can be reopened in a web interface with `boo open`, and results can be exported as CSV. A process monitor can detect crashes and restart applications on Windows or Linux, but must run on the target machine. The optional network monitor requires Pcapy and Impacket, which are not installed automatically. Public FTP and HTTP protocol libraries are documented, though their implementations do not provide full protocol coverage. The project describes extensibility for instrumentation and failure detection. It uses the GPL-2.0 license; usage questions are directed to Stack Overflow, while bugs and suggestions can go to GitHub issues or pull requests.
Spec sheet
- Purpose
- Boofuzz is a network protocol fuzzing framework and a fork and successor to Sulley.Read 5 Oct 2026 · github.com
- Support
- The project directs users to Stack Overflow for usage questions and GitHub issues for bugs and suggestions.Read 4 Oct 2026 · github.com
- License
- The GitHub repository identifies the project license as GPL-2.0.Read 4 Oct 2026 · github.com
- Communications
- It supports arbitrary communications media, including serial, Ethernet and IP layer, and UDP broadcast fuzzing.Read 4 Oct 2026 · boofuzz.readthedocs.io
- Community support
- The project directs bug reports and improvement ideas to GitHub issues or pull requests and suggests Stack Overflow for usage questions.Read 5 Oct 2026 · github.com
- Connections
- Documented connection options include TCP, UDP, SSL, raw sockets, and serial connections.Read 5 Oct 2026 · boofuzz.readthedocs.io
- Documentation
- The project provides online documentation with quickstarts and API documentation.Read 4 Oct 2026 · boofuzz.readthedocs.io
- Extensibility
- The project describes extensibility as a goal and supports extending instrumentation and failure detection.Read 5 Oct 2026 · github.com
- Fuzzer workflow
- It provides data generation, failure detection instrumentation, target reset after failure, and test data recording.Read 5 Oct 2026 · github.com
- Fuzzing workflow
- Its core capabilities include data generation, failure detection, target reset after failure, and recording test data.Read 4 Oct 2026 · boofuzz.readthedocs.io
- Installation
- Boofuzz installs with pip as a Python library used to build fuzzer scripts.Read 5 Oct 2026 · github.com
- Monitoring
- The process monitor detects crashes and restarts applications on Windows or Linux, and must run on the target machine.Read 4 Oct 2026 · github.com
- Optional dependency
- The network monitor requires Pcapy and Impacket, which are not installed automatically with boofuzz.Read 4 Oct 2026 · github.com
- Protocol libraries
- The documentation links free, open-source FTP and HTTP protocol libraries and says their implementations do not provide full protocol coverage.Read 5 Oct 2026 · boofuzz.readthedocs.io
- Protocol suites
- The documentation lists public boofuzz FTP and HTTP protocol libraries and says their implementations do not approach full protocol coverage.Read 4 Oct 2026 · boofuzz.readthedocs.io
- Protocol support
- It supports arbitrary communication media and includes serial, Ethernet and IP-layer, and UDP broadcast fuzzing.Read 5 Oct 2026 · github.com
- Python requirement
- The installation guide requires Python 3.8 or later and recommends pip.Read 5 Oct 2026 · boofuzz.readthedocs.io
- Results
- Boofuzz records test data and can export test results as CSV.Read 5 Oct 2026 · github.com
- Run logs
- Each run's log data is saved to a SQLite database in the boofuzz-results directory.Read 5 Oct 2026 · boofuzz.readthedocs.io
- Security and license
- GitHub identifies the repository license as GPL-2.0.Read 5 Oct 2026 · github.com
- Target monitoring
- The process monitor detects crashes and restarts applications on Windows or Linux, and must run on the target machine.Read 5 Oct 2026 · boofuzz.readthedocs.io
- Web interface
- The quickstart says users can reopen the web interface on a saved run database with the boo open command.Read 5 Oct 2026 · boofuzz.readthedocs.io
Plans and prices
Free and open source Free Python library for building fuzzer scripts · GPL-2.0 license Read 5 Oct 2026 · github.com
Strong points and limits
Strong points
- Supports TCP, UDP, SSL, raw sockets, and serial.
- Records run data in a SQLite database.
- Can export results as CSV.
- Process monitor detects crashes on Windows or Linux.
Limits
- Requires Python 3.9 or later.
- Optional network monitor dependencies are not installed automatically.
- Process monitor must run on the target machine.
- FTP and HTTP libraries do not provide full coverage.
Who it suits
boofuzz suits developers building Python scripts to fuzz network protocols or other supported communication targets. It is a fit for users able to manage its Python requirement and optional monitoring dependencies.
Verdict
boofuzz combines data generation, failure detection, target reset, and run logging across several connection types. Account for the Python version requirement, monitor setup, and limited coverage of its documented FTP and HTTP libraries.
Where Specifiction places it
- Fuzz Testing Software#3 of 268.7
