---
id: boofuzz
version: "0.4.2"
license: GPL-2.0-only
license_treatment: copyleft
maintenance: active
---

# boofuzz — A fork and successor of the Sulley Fuzzing Framework

License: copyleft · Maintenance: active · Downloads: 76.8K/mo

## What it is and what it does

Boofuzz is a successor to the Sulley fuzzing framework, designed to systematically test network protocols and services by generating malformed, unexpected, or edge-case data and observing how targets respond. It combines data generation, instrumentation (failure detection), target reset, and test recording into a cohesive fuzzing workflow. The framework supports multiple communication mediums—TCP, UDP, serial, raw Ethernet and IP layers, Unix sockets, and NETCONF—making it applicable to a wide range of protocol testing scenarios.

The package provides both a programmatic API for building custom fuzz scripts and a command-line interface for generic fuzzing workflows. It records test results to CSV, maintains a database of test cases, and includes a web UI for monitoring fuzzing progress. Boofuzz is actively maintained, supports Python 3.8 through 3.11, and aims to be more accessible and extensible than its predecessor while incorporating lessons learned from years of open-source fuzzing practice.

Use it for:

- Discover vulnerabilities in network services by systematically testing protocol implementations with malformed inputs.
- Validate robustness of embedded devices or IoT systems that communicate over serial, Ethernet, or IP protocols.
- Test custom protocol implementations during development to catch edge cases before deployment.
- Fuzz NETCONF servers or other standardized network protocols to ensure compliance and stability.
- Generate and replay specific test cases to reproduce and verify fixes for protocol handling bugs.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Boofuzz is a network protocol fuzzing framework that generates malformed or unexpected data to test network services for robustness and security vulnerabilities.

Yes, if you are conducting security testing or protocol validation and accept the GPL-2.0-only copyleft license. Boofuzz is actively maintained, has low install friction, carries no known vulnerabilities, and provides a mature, well-documented fuzzing framework. Not suitable for proprietary projects without separate licensing or if you require a permissive license.

## Install

pip install boofuzz
uv add boofuzz
poetry add boofuzz

## Installing boofuzz

Before you install: Low install friction with a pure Python wheel distribution and nine runtime dependencies that are all widely available. The project is actively maintained with a recent commit on 2026-08-06 and has been in active development since its first release in 2016.

License in practice: Boofuzz is licensed under GPL-2.0-only (copyleft). Any code that links to or distributes boofuzz must be released under compatible terms; proprietary projects cannot use this library without separate licensing arrangements.

Quickstart:

pip install boofuzz

from boofuzz import Session, s_string, s_int

session = Session()
session.connect(target_host, target_port)
session.fuzz()

Requires Python 3.8 or later. Fuzzing a live target requires network access and a running service to test against.

Verify before relying:

- Whether the web UI (added in v0.4.2) requires additional system dependencies or configuration beyond the listed runtime packages.
- Performance characteristics when fuzzing large protocol definitions or high-volume targets.
- Compatibility with Windows serial fuzzing given the pyserial dependency and platform-specific behavior.

## Package facts

- License: GPL-2.0-only (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 76.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

network protocol fuzzing, fuzz testing framework, vulnerability discovery tool, protocol testing automation, network service fuzzer, security testing framework, malformed data generation, security-testing, protocol-fuzzing, vulnerability-discovery

[View on SkillFed](https://skillfed.io/packages/boofuzz) · [View on PyPI](https://pypi.org/project/boofuzz/)