# Install zzuf with Homebrew, apt, dnf, MacPorts, Nix, pacman Transparent application input fuzzer. Version 0.15 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:zzuf ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install zzuf ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install zzuf ``` Evidence: MacPorts ports tree: security/zzuf/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install zzuf ``` Evidence: Debian stable package indexes: zzuf from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install zzuf ``` Evidence: Fedora Rawhide package metadata: zzuf from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#zzuf ``` Evidence: nixpkgs package indexes: pkgs/by-name/zz/zzuf/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S zzuf ``` Evidence: Arch Linux sync databases: zzuf from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## Package facts - **Package key:** brew:zzuf - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.15 - **Source summary:** Transparent application input fuzzer - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** WTFPL - **Source archive:** - **Generated:** 2026-07-09T07:20:21+00:00 ## Executables - zzat (cli) - zzuf (cli) - zzat (alias) - zzuf (alias) ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura ## Freshness - Page generated: 2026-07-09 - Package-manager version: 0.15 - Local data: ok - Upstream repository: https://github.com/samhocevar/zzuf - info: No package-manager update timestamp was available. - info: No cached GitHub release or tag data was available. ## Project history and usage zzuf is Sam Hocevar's transparent application input fuzzer. It runs a target program while intercepting file and network operations, flips bits in input data deterministically, and reports crashes or other interesting behavior. ### Project history zzuf grew out of the mid-2000s security and QA fuzzing culture around media parsers, image viewers, web browsers, and command-line utilities that consumed untrusted files. The Caca Labs page describes the project as a multi-purpose fuzzer whose goal is to make input fuzzing easier and more automated rather than inventing fuzzing itself. The project had public talks and downloadable material by 2007 and 2008, including FOSDEM 2007 and Hacker Space Festival 2008 slides linked from the project page. The same page records early tarball attachments from 2008 and later snapshots, while the current development home is GitHub. The manual-page source documents the mature command-line model: zzuf can run one program many times, vary seeds and fuzzing ratios, limit time, memory, bytes, and crashes, fuzz stdin when no command is given, and use preload or copy modes depending on platform support. ### Adoption history zzuf's own site names several adoption signals: Goatse Security used it against third-party applications, Adobe security researchers used it to stress-test applications and libraries, and CERT's Basic Fuzzing Framework was based on zzuf. The Fuzzing Project FAQ also lists zzuf as a simple, basic fuzzing tool for random input modification. Its broader adoption is the classic small security-tool pattern: package managers keep a reproducible CLI available even after newer coverage-guided fuzzers became dominant, because zzuf is still useful for quick black-box corruption tests and deterministic reproducers. ### How it is used Typical usage is to prefix a command with zzuf, set a seed or seed range, and choose a corruption ratio. If a run crashes, the same seed can reproduce the mutated input; simple tools such as cat or cp can then materialize the exact fuzzed file for debugging or regression tests. The manual also supports batch testing behavior: multiple jobs, maximum crash counts, wall-clock and CPU limits, output byte limits, memory limits, include/exclude filters, protected byte ranges, and network-fuzzing filters. That made zzuf useful both as a one-off terminal tool and as a scriptable QA/security harness. ### Why package nerds care zzuf matters to package nerds because it is a compact Unix-style security tool with a long tail. It exposes a single memorable command, but underneath it depends on platform loader behavior, libc/file-operation interception, signal handling, and resource limits, which are exactly the details package maintainers have to preserve across operating systems. It also captures a pre-AFL era of fuzzing in package form: deterministic random mutation, no source instrumentation, easy shell integration, and enough knobs to turn a simple idea into a practical crash-finding workflow. ### Timeline - 2007: The project page links FOSDEM 2007 zzuf presentation slides. - 2008: The project page links Hacker Space Festival 2008 slides and records early zzuf tarball attachments. - 2010: The Caca Labs attachment list records later zzuf and Mac OS X snapshot tarballs. - 2015-01-06: The bundled manual page source is dated 2015-01-06. - 2015-06-09: The Caca Labs zzuf page records its last modification by Sam Hocevar. ### Related projects - Related projects and tools include CERT Basic Fuzzing Framework, american fuzzy lop, libFuzzer, honggfuzz, radamsa, Valgrind, AddressSanitizer, media players, image viewers, web browsers, objdump, and other parser-heavy targets for black-box fuzzing. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** zzuf - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - zzuf - 0.15-5+b1: normalized package name match | Debian stable package indexes: zzuf from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | transparent application fuzzer | https://caca.zoy.org/wiki/zzuf - Nix - zzuf: normalized package name match | nixpkgs package indexes: pkgs/by-name/zz/zzuf/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - zzuf - 0.15-2build3: normalized package name match | Ubuntu 24.04 LTS package indexes: zzuf from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | transparent application fuzzer | https://caca.zoy.org/wiki/zzuf - dnf - zzuf - 0.15-26.fc44: normalized package name match | Fedora Rawhide package metadata: zzuf from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Transparent application input fuzzer | http://sam.zoy.org/zzuf/ - pacman - zzuf - 0.15-3: normalized package name match | Arch Linux sync databases: zzuf from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Transparent application input fuzzer | https://github.com/samhocevar/zzuf - MacPorts - zzuf: normalized package name match | MacPorts ports tree: security/zzuf/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [cargo-fuzz](https://www.automicvault.com/pkg/brew/cargo-fuzz/) - Shares av.db curated category or tags: cli, developer-tools, fuzzing, testing. - [allure](https://www.automicvault.com/pkg/brew/allure/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [artillery](https://www.automicvault.com/pkg/brew/artillery/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [busted](https://www.automicvault.com/pkg/brew/busted/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [bzt](https://www.automicvault.com/pkg/brew/bzt/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [cargo-hack](https://www.automicvault.com/pkg/brew/cargo-hack/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [cargo-insta](https://www.automicvault.com/pkg/brew/cargo-insta/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [cargo-nextest](https://www.automicvault.com/pkg/brew/cargo-nextest/) - Shares av.db curated category or tags: cli, developer-tools, testing. - [promptfoo](https://www.automicvault.com/pkg/npm/promptfoo/) - Local package facts share a topical domain. Shared terms: cli, developer, developer-tools, input, testing. ## Combined YAML source View the package source record on GitHub. [combined/zzuf.yml](https://github.com/automic-vault/db/blob/main/combined/zzuf.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph