Pretty much it. You often provide them with a corpus and they start mutating it and trying lots of random data based on it with the goal being to crash code.

Pretty much it. You often provide them with a corpus and they start mutating it and trying lots of random data based on it with the goal being to crash code. Fuzzing actually catches a remarkable number of problems with code. The one I've seen the most of recently in general, and probably the highest quality blogs about it, has been American Fuzzy Loop, AFL: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ there are a number of programs in its treasure chest, I'd encourage looking at a few of the links if you're even remotely curious about the bugs fuzzing can expose. This one has been making a fair splash in the go community, take a look at the trophy list about a third of the way down the page: https://github.com/dvyukov/go-fuzz https://github.com/dvyukov/go-fuzz