EvoMaster vs FuzzForge
EvoMaster
github.com
FuzzForge
fuzzforge.aiSide by side
| Figure | EvoMaster | FuzzForge |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Fuzz Testing Software | 8.3 (#8) | 7.5 (#14) |
| Founded | 2016 | 2021 |
| Integrations | It can run in GitHub Actions through a custom action and is distributed as a Docker image. | FuzzingLabs describes workflows that combine tools such as Semgrep, CodeQL, AFL, LibFuzzer, Ghidra, angr and QEMU. |
| Purpose | EvoMaster automatically generates system-level tests through fuzzing for web and enterprise applications. | FuzzForge runs fuzzing, emulation and reverse engineering campaigns for embedded and connected product security testing. |
| Support | The project directs users to GitHub issues and discussions for documentation and usage questions. | The product page offers a demo request and describes campaign findings as work engineers can pick up and verify. |
Plans
In their own words
EvoMaster
EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or suites in Python or JavaScript. More than 30 oracles check issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions with PostgreSQL, MySQL, H2, and MongoDB support. Authentication accepts headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1. PyPI is the recommended installation route, with Docker and an uber-fat JAR also available. EvoMaster runs on Linux, macOS, Windows, and self-hosted environments, and integrates with GitHub Actions through a custom action.