[jzcoder]

Instead of pure random data, fuzzers can use 'attack heuristics' to try and minimize the search space. These are specific patterns that are more likely to expose bugs, based on previous vulnerabilities and known coding errors. For example using '%n%n%n%n%n' many times to exploit C-style format string stack vulnerabilities.

Mozilla started a project known as FuzzDB to collect these heuristics, although it doesn't appear to have been maintained recently.

Here's some examples from FuzzDB: https://code.google.com/p/fuzzdb/source/browse/trunk/attack-...

[jzcoder]

Here's another set of examples, for different targets:

https://www.owasp.org/index.php/OWASP_Testing_Guide_Appendix...