EvoMaster vs Jazzer

EvoMaster automatically generates system-level tests for web and enterprise applications by fuzzing APIs. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box testing works across implementation languages; white-box testing is available for APIs compiled to the JVM, such as Java and Kotlin. The tool evolves test cases using evolutionary algorithms, dynamic program analysis, and AI heuristics to improve measures such as code coverage and fault detection. Its project describes more than 30 fault-detection oracles, covering issues such as HTTP status problems, schema mismatches, BOLA, and SQL injection. Generated results can include JUnit 4 or 5 tests in Java or Kotlin, Python or JavaScript test suites, and an interactive HTML report by default. White-box testing supports PostgreSQL, MySQL, H2, and MongoDB communications and can generate database initialization. Authentication headers and cookies are supported, as is dynamic credential retrieval through configured login endpoints. EvoMaster is free, has no telemetry, and says it needs no external internet services beyond the application under test. It can run on Linux, macOS, Windows, or self-hosted; PyPI is the recommended installation route, with a JAR and Docker image also available.

Jazzer is a free, coverage-guided fuzzer for JVM applications, running in-process and based on libFuzzer. It supports Java, Kotlin, Scala, and Clojure targets, as well as JNI and native libraries. With JUnit 5.9.0 or newer, fuzz tests can run alongside regular unit tests. The @FuzzTest annotation lets Jazzer generate and mutate method inputs, including primitives, strings, arrays, and standard library classes. JUnit fuzz tests can use saved crashing inputs in regression mode or generate and mutate inputs to explore coverage. Built-in sanitizers detect Java security issues such as SSRF, file path traversal, and OS command injection, and provide feedback to guide fuzzing. The README documents use with Maven, Gradle, and Bazel. Jazzer can also run as a standalone binary or through its Java main class. Supported systems are Linux x86_64 and arm64, macOS 12 or newer on x86_64 and arm64, and Windows x86_64. The jazzer-junit package is available on Maven Central, and the repository identifies the project as licensed under Apache-2.0.