PurpleTeam vs WuppieFuzz
PurpleTeam
purpleteam-labs.comWuppieFuzz
github.comSide by side
| Figure | PurpleTeam | WuppieFuzz |
|---|---|---|
| Price from | $85/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 2 |
| Spec score · API Security Testing Software | 7.7 (#15) | 8.2 (#8) |
| Support | The Community plan lists community Slack, GitHub Issues, GitHub Discussions, full documentation, and full source code; the Pro plan lists email support with a 48-hour response. | TNO invites users to contact it for help, ideas, or information about automated reliability and security testing tools. |
| What it does | PurpleTeam is a CLI and service that runs dynamic application security testing against web applications and APIs. | WuppieFuzz is a coverage-guided REST API fuzzer built on LibAFL. |
Plans
PurpleTeam
- CommunityFree
- Standard$85 a month
- Pro$185 a month
- EnterprisePriced on request
In their own words
PurpleTeam
PurpleTeam is a command-line tool and service for dynamic application security testing of web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs; supported API formats include OpenAPI, SOAP, and GraphQL. The CLI runs headlessly in build pipelines, with scans scheduled on commit, push, nightly, or on demand. Results identify defect locations, provide remediation guidance and reproduction instructions, and suggest ways to find similar issues. Attack strength and alert thresholds are adjustable, including thresholds for existing defects that should not fail a run. A CLI process can run without specific integrations. Documentation describes local OWASP and cloud BinaryMist environments, with cloud onboarding by contacting the maker. Community is free, hosted locally, and includes unlimited scans, unlimited targets, and 12 concurrent test sessions. Standard costs $85 a month on annual billing; Pro costs $185 a month on annual billing. Monthly prices shown are $110 and $240. A 14-day trial is available.
WuppieFuzz
WuppieFuzz is a free, open-source, self-hosted REST API fuzzer built on LibAFL. It generates and mutates requests from an OpenAPI specification to seek potential errors and security flaws. Black-box, grey-box, and white-box testing are supported, along with authentication and input-validation testing. Authentication formats include Bearer, custom, cookie, OAuth, and Web Fuzzing Commons. Code coverage is supported for Java, JavaScript, and Python, while code coverage reports currently support JaCoCo. The tool can produce endpoint coverage reports, and a Grafana dashboard can visualize request information from a fuzzing campaign. It runs on Windows, macOS, and Linux and uses the Apache 2.0 license. TNO says fuzzing data is not shared with TNO or third parties. The tool is described for software development, supply-chain quality control, or penetration testing. WuppieFuzz requires an OpenAPI document in JSON or YAML to generate requests, and API discovery is not supported. Its plan costs nothing.