Automatic API Attack Tool vs WuppieFuzz
Automatic API Attack Tool
github.comWuppieFuzz
github.comSide by side
| Figure | Automatic API Attack Tool | WuppieFuzz |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 2 |
| Spec score · API Security Testing Software | 8.2 (#7) | 8.2 (#8) |
| Extensibility | The project says its fuzzing and request generation functionality can be extended for specific needs. | The project invites contributions such as new language coverage agents and mutation techniques. |
| License | The repository lists an MIT license. | WuppieFuzz is available under the Apache 2.0 license. |
| Purpose | The tool takes an API specification as input and generates and runs attacks based on it. | WuppieFuzz is a coverage-guided REST API fuzzer built on LibAFL to find potential errors and security flaws. |
| Support | The README directs users to source code documentation and gives an email address for questions; it directs bug reports to GitHub Issues. | TNO invites users to contact it for help, ideas, or information about automated reliability and security testing tools. |
Plans
In their own words
Automatic API Attack Tool
Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.
WuppieFuzz
WuppieFuzz is a free, open-source, self-hosted REST API fuzzer built on LibAFL. It generates and mutates requests from an OpenAPI specification to seek potential errors and security flaws. Black-box, grey-box, and white-box testing are supported, along with authentication and input-validation testing. Authentication formats include Bearer, custom, cookie, OAuth, and Web Fuzzing Commons. Code coverage is supported for Java, JavaScript, and Python, while code coverage reports currently support JaCoCo. The tool can produce endpoint coverage reports, and a Grafana dashboard can visualize request information from a fuzzing campaign. It runs on Windows, macOS, and Linux and uses the Apache 2.0 license. TNO says fuzzing data is not shared with TNO or third parties. The tool is described for software development, supply-chain quality control, or penetration testing. WuppieFuzz requires an OpenAPI document in JSON or YAML to generate requests, and API discovery is not supported. Its plan costs nothing.