AFL++ vs EvoMaster

AFL++ is a coverage-guided fuzzer that changes input and checks whether a target binary reaches a new execution path. Its afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. Documentation covers source-available software, binary-only targets, network services and GUI programs, with build options for source-only, binary-only or combined distributions. A Docker image supports x86_64 and arm64; its example mounts target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build guidance covers x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and create heavy filesystem activity. AFL++ is available free under AGPL terms; modified versions offered as network services must provide users the corresponding source. A commercial license is listed at €20,000 a year.

EvoMaster automatically generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box testing works across implementation languages; white-box testing is available for APIs compiled to the JVM, such as Java and Kotlin. The tool evolves test cases using evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. Its project describes more than 30 fault-detection oracles, covering issues such as HTTP status problems, schema mismatches, BOLA, and SQL injection. Generated results can include JUnit 4 or 5 tests in Java or Kotlin, Python or JavaScript test suites, and an interactive HTML report by default. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. Authentication headers and cookies are supported, as is dynamic credential retrieval through configured login endpoints. EvoMaster is free, has no telemetry, and says it needs no external internet services beyond the application under test. It can run on Linux, macOS, Windows, or self-hosted; PyPI is the recommended installation route, with a JAR and Docker image also available.