EvoMaster vs Jazzer

EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or suites in Python or JavaScript. More than 30 oracles check issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions with PostgreSQL, MySQL, H2, and MongoDB support. Authentication accepts headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1. PyPI is the recommended installation route, with Docker and an uber-fat JAR also available. EvoMaster runs on Linux, macOS, Windows, and self-hosted environments, and integrates with GitHub Actions through a custom action.

Jazzer is a free, coverage-guided fuzzer for JVM applications, running in-process and based on libFuzzer. It supports Java, Kotlin, Scala, and Clojure targets, as well as JNI and native libraries. With JUnit 5.9.0 or newer, fuzz tests can run alongside regular unit tests. The @FuzzTest annotation lets Jazzer generate and mutate method inputs, including primitives, strings, arrays, and standard library classes. JUnit fuzz tests can use saved crashing inputs in regression mode or generate and mutate inputs to explore coverage. Built-in sanitizers detect Java security issues such as SSRF, file path traversal, and OS command injection, and provide feedback to guide fuzzing. The README documents use with Maven, Gradle, and Bazel. Jazzer can also run as a standalone binary or through its Java main class. Supported systems are Linux x86_64 and arm64, macOS 12 or newer on x86_64 and arm64, and Windows x86_64. The jazzer-junit package is available on Maven Central, and the repository identifies the project as licensed under Apache-2.0.