EvoMaster vs Netzob

EvoMaster is a free, open-source tool that uses fuzzing to generate system-level tests for web and enterprise applications. It targets REST, GraphQL, and RPC APIs, including gRPC and Thrift. Black-box mode works with APIs in any programming language, while white-box mode analyzes JVM bytecode. Generated tests can be JUnit 4 or 5 in Java or Kotlin, or suites in Python or JavaScript. More than 30 oracles check issues including HTTP 500 responses, schema mismatches, BOLA, and SQL injection. White-box testing can analyze SQL and MongoDB interactions with PostgreSQL, MySQL, H2, and MongoDB support. Authentication accepts headers and cookies, including tokens or cookies obtained from a login endpoint. REST testing requires OpenAPI 2.0, 3.0, or 3.1. PyPI is the recommended installation route, with Docker and an uber-fat JAR also available. EvoMaster runs on Linux, macOS, Windows, and self-hosted environments, and integrates with GitHub Actions through a custom action.

Netzob is a free, GPLv3-licensed open-source tool for reverse engineering, traffic generation, and fuzzing of communication protocols. It infers message formats and protocol state machines through passive and active processes. Vocabulary inference learns formats from supplied traces, while grammar inference supports semi-automatic state-machine learning. With those models, its simulator can act as a client, server, or both to generate traffic. The fuzzing module creates optimized test cases by mutation or generation. Inputs can include live network traffic, PCAP captures, IPC, text and binary files, and API flows through supported formats. Exports include XML, human-readable output, and Peach fuzzer formats, with custom exporters possible. Netzob runs locally on Linux and Windows and supports Python 3. It targets network protocols, structured files, text protocols, drivers, devices, and other listed target types. Version 0.4.1 is listed as the latest stable release, with packages dated February 2, 2013.