AFL++ vs Mayhem

AFL++ is a coverage-guided fuzzer that changes input and checks whether a target binary reaches a new execution path. Its afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. Documentation covers source-available software, binary-only targets, network services and GUI programs, with build options for source-only, binary-only or combined distributions. A Docker image supports x86_64 and arm64; its example mounts target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build guidance covers x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and create heavy filesystem activity. AFL++ is available free under AGPL terms; modified versions offered as network services must provide users the corresponding source. A commercial license is listed at €20,000 a year.

Mayhem is a security platform for testing code and APIs and assessing software components in a dashboard. Its fuzzing combines AI-powered, network-aware methods with symbolic execution and triage. For code, it generates tests autonomously to find vulnerabilities and supplies a reproduction and backtrace for each defect. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis helps identify which software components are on the attack surface. The platform produces vendor-neutral SARIF reports and real-time notifications, and lists integrations with tools including GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Deployment options include managed SaaS, private cloud and closed-network installation; command-line tools run on macOS, Linux and Windows. The Mayhem for API free plan allows up to 50 scans per month. Paid API plans cost $236 a month, with additional scans, enterprise features and personalized support; a 30-day trial is listed for paid plans.