AFL++ vs Schemathesis

AFL++ is a coverage-guided fuzzer that changes input and checks whether a target binary reaches a new execution path. Its afl-cc compiler supports LTO, LLVM and GCC_PLUGIN instrumentation. The project also lists collision-free coverage, AFLfast++ power schedules, MOpt mutators, laf-intel and redqueen. Documentation covers source-available software, binary-only targets, network services and GUI programs, with build options for source-only, binary-only or combined distributions. A Docker image supports x86_64 and arm64; its example mounts target source at /src. On Linux, the installation guide recommends LLVM 18 or newer and gives LLVM 14 as the minimum. macOS build guidance covers x86_64 and arm64, but afl-clang-lto, afl-gcc-fast and qemu_mode do not work there. Fuzzing can strain hardware, consume substantial memory or disk, and create heavy filesystem activity. AFL++ is available free under AGPL terms; modified versions offered as network services must provide users the corresponding source. A commercial license is listed at €20,000 a year.

Schemathesis generates property-based tests from OpenAPI and GraphQL schemas to help engineers find API bugs. Its cases probe boundary values, type mismatches and constraint violations, and it validates API responses against the OpenAPI specification. For multi-step workflows, it chains operations using links inferred from a schema. During a run, it can learn validation rules, resource IDs and authentication requirements from server responses, then reuse them. Users can add Python checks for business rules alongside built-in checks. It supports OpenAPI 2.0, 3.0, 3.1 and 3.2, plus GraphQL schemas. Authentication options include Bearer tokens, Basic authentication and API keys, with environment variable substitution and Python hooks for dynamic flows. Integrations include a GitHub Action, Docker image, pip or uvx installation, and pytest. Reports can be exported as JUnit, VCR, HAR, NDJSON, JSON or Allure; failures can also be saved with curl commands for replay. The tool is self-hosted and licensed under MIT.