boofuzz vs Schemathesis

boofuzz is a network protocol fuzzing framework and a successor to Sulley. It installs as a Python library for building fuzzer scripts, using `pip install boofuzz`, and requires Python 3.9 or later. Its workflow generates data, detects failures, resets targets after failures, and records test data. It supports varied communications, including serial, Ethernet and IP-layer traffic, UDP broadcast, TCP, UDP, SSL, and raw sockets. Run logs are saved in a SQLite database in the boofuzz-results directory, saved runs can be reopened in a web interface with `boo open`, and results can be exported as CSV. A process monitor can detect crashes and restart applications on Windows or Linux, but must run on the target machine. The optional network monitor requires Pcapy and Impacket, which are not installed automatically. Public FTP and HTTP protocol libraries are documented, though their implementations do not provide full protocol coverage. The project describes extensibility for instrumentation and failure detection. It uses the GPL-2.0 license; usage questions are directed to Stack Overflow, while bugs and suggestions can go to GitHub issues or pull requests.

Schemathesis generates property-based tests from OpenAPI and GraphQL schemas to help engineers find API bugs. Its cases probe boundary values, type mismatches and constraint violations, and it validates API responses against the OpenAPI specification. For multi-step workflows, it chains operations using links inferred from a schema. During a run, it can learn validation rules, resource IDs and authentication requirements from server responses, then reuse them. Users can add Python checks for business rules alongside built-in checks. It supports OpenAPI 2.0, 3.0, 3.1 and 3.2, plus GraphQL schemas. Authentication options include Bearer tokens, Basic authentication and API keys, with environment variable substitution and Python hooks for dynamic flows. Integrations include a GitHub Action, Docker image, pip or uvx installation, and pytest. Reports can be exported as JUnit, VCR, HAR, NDJSON, JSON or Allure; failures can also be saved with curl commands for replay. The tool is self-hosted and licensed under MIT.