Bright Security DAST vs WuppieFuzz

Bright Security DAST is a dynamic application security testing tool offered as SaaS. It tests websites, web applications, APIs including REST, SOAP, and GraphQL, servers, and network devices; it also tests mobile applications on the server side. Checks include SQL injection, CSRF, XSS, XXE, and business logic vulnerabilities. Bright says it validates findings in real time and does not report issues it cannot validate, with less than 3% false positives among its verified findings. Target discovery can use a crawler, HAR recording, or GraphQL and OpenAPI schemas. Authentication objects let scans reach login-protected application and API resources. Teams can initiate scans from CI/CD pipelines and control them through the CLI or REST API without using the interface. The CLI's Repeater mode routes requests to local targets without exposing them to the internet. Bright lists SaaS, private cloud, and Repeater proxy deployment options. Scan quantity is unlimited, but the number of concurrent scans depends on the organization's engine count. Bright says scan data is held in memory temporarily and deleted after scanning. The tool cannot handle CAPTCHA during scans. Pricing is available on request, with a demo offered.

WuppieFuzz is a free, open-source, self-hosted REST API fuzzer built on LibAFL. It generates and mutates requests from an OpenAPI specification to seek potential errors and security flaws. Black-box, grey-box, and white-box testing are supported, along with authentication and input-validation testing. Authentication formats include Bearer, custom, cookie, OAuth, and Web Fuzzing Commons. Code coverage is supported for Java, JavaScript, and Python, while code coverage reports currently support JaCoCo. The tool can produce endpoint coverage reports, and a Grafana dashboard can visualize request information from a fuzzing campaign. It runs on Windows, macOS, and Linux and uses the Apache 2.0 license. TNO says fuzzing data is not shared with TNO or third parties. The tool is described for software development, supply-chain quality control, or penetration testing. WuppieFuzz requires an OpenAPI document in JSON or YAML to generate requests, and API discovery is not supported. Its plan costs nothing.