Jazzer vs Mayhem

Jazzer is a free, coverage-guided fuzzer for JVM applications, running in-process and based on libFuzzer. It supports Java, Kotlin, Scala, and Clojure targets, as well as JNI and native libraries. With JUnit 5.9.0 or newer, fuzz tests can run alongside regular unit tests. The @FuzzTest annotation lets Jazzer generate and mutate method inputs, including primitives, strings, arrays, and standard library classes. JUnit fuzz tests can use saved crashing inputs in regression mode or generate and mutate inputs to explore coverage. Built-in sanitizers detect Java security issues such as SSRF, file path traversal, and OS command injection, and provide feedback to guide fuzzing. The README documents use with Maven, Gradle, and Bazel. Jazzer can also run as a standalone binary or through its Java main class. Supported systems are Linux x86_64 and arm64, macOS 12 or newer on x86_64 and arm64, and Windows x86_64. The jazzer-junit package is available on Maven Central, and the repository identifies the project as licensed under Apache-2.0.

Mayhem is a security platform for testing code and APIs and assessing software components in a dashboard. Its fuzzing combines AI-powered, network-aware methods with symbolic execution and triage. For code, it generates tests autonomously to find vulnerabilities and supplies a reproduction and backtrace for each defect. Mayhem for API tests for OWASP Top 10 API weaknesses and supports stateful, agentless testing. Dynamic SBOM reachability analysis helps identify which software components are on the attack surface. The platform produces vendor-neutral SARIF reports and real-time notifications, and lists integrations with tools including GitHub, Jenkins, GitLab, Jira, Slack, CircleCI, Azure DevOps, Google Chat and Travis CI. Deployment options include managed SaaS, private cloud and closed-network installation; command-line tools run on macOS, Linux and Windows. The Mayhem for API free plan allows up to 50 scans per month. Paid API plans cost $236 a month, with additional scans, enterprise features and personalized support; a 30-day trial is listed for paid plans.