Alternatives to BlackArch Fuzzer
Compare BlackArch Fuzzer alternatives for your business or organization using the curated list below. SourceForge ranks the best alternatives to BlackArch Fuzzer in 2026. Compare features, ratings, user reviews, pricing, and more from BlackArch Fuzzer competitors and alternatives in order to make an informed decision for your business.
-
1
BlackArch Linux
BlackArch Linux
BlackArch Linux is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installs. The BlackArch Full ISO contains multiple window managers. The BlackArch Slim ISO features XFCE Desktop Enviroment. The full ISO contains a complete, functional BlackArch Linux system with all the available tools in the repo at build time. The slim ISO contains a functional BlackArch Linux system with a selected set of common/well-known tools and system utilities for pentesting. The netinstall ISO is a lightweight image for bootstrapping machines with a minimal set of packages. BlackArch Linux is compatible with existing/normal Arch installations. It acts as an unofficial user repository. You can install BlackArch Linux using the Slim medium which features GUI installer. -
2
Atheris
Google
Atheris is a coverage-guided Python fuzzing engine. It supports fuzzing of Python code, but also native extensions written for CPython. Atheris is based on libFuzzer. When fuzzing native code, Atheris can be used to catch extra bugs. Atheris supports Linux (32- and 64-bit) and Mac OS X, with Python versions 3.6-3.10. It comes with a built-in libFuzzer, which is fine for fuzzing Python code. If you plan to fuzz native extensions, you may need to build from source to ensure the libFuzzer version in Atheris matches your Clang version. Atheris relies on libFuzzer, which is distributed with Clang. Apple Clang doesn't come with libFuzzer, so you'll need to install a new version of LLVM. Atheris is based on a coverage-guided mutation-based fuzzer (LibFuzzer). This has the advantage of not requiring any grammar definition for generating inputs, making its setup easier. The disadvantage is that it will be harder for the fuzzer to generate inputs for code that parses complex data types.Starting Price: Free -
3
Defensics Fuzz Testing
Black Duck
Defensics Fuzz Testing is a comprehensive, versatile, automated black box fuzzer that enables organizations to efficiently and effectively discover and remediate security weaknesses in software. The generational fuzzer takes an intelligent, targeted approach to negative testing. Advanced file and protocol template fuzzers enable users to build their own test cases. The SDK allows expert users to use the Defensics framework to develop their own test cases. Defensics is a black box fuzzer, meaning it doesn’t require source code to run. With Defensics, users can secure their cyber supply chain to ensure the interoperability, robustness, quality, and security of software and devices before introducing them into IT or lab environments. Defensics fits nearly any development workflow, whether in a traditional SDL or CI environment. Its API and data export capabilities also enable it to integrate with surrounding technologies, making it a true plug-and-play fuzzer. -
4
Google ClusterFuzz
Google
ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features to seamlessly integrate fuzzing into a software project’s development process. Fully automatic bug filing, triage, and closing for various issue trackers. Supports multiple coverages guided fuzzing engines for optimal results (with ensemble fuzzing and fuzzing strategies). Statistics for analyzing fuzzer performance, and crash rates. Easy to use web interface for management and viewing crashes. Support for various authentication providers using Firebase. Support for black-box fuzzing, test case minimization, and regression finding through bisection.Starting Price: Free -
5
ClusterFuzz
Google
ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software. Google uses ClusterFuzz to fuzz all Google products and as the fuzzing backend for OSS-Fuzz. ClusterFuzz provides many features to seamlessly integrate fuzzing into a software project’s development process. Fully automatic bug filing, triage, and closing for various issue trackers. Supports multiple coverages guided fuzzing engines for optimal results (with ensemble fuzzing and fuzzing strategies). Statistics for analyzing fuzzer performance, and crash rates. Easy to use web interface for management and viewing crashes. Support for various authentication providers using Firebase. Support for black-box fuzzing, test case minimization, and regression finding through bisection. -
6
LibFuzzer
LLVM Project
LibFuzzer is an in-process, coverage-guided, evolutionary fuzzing engine. LibFuzzer is linked with the library under test, and feeds fuzzed inputs to the library via a specific fuzzing entry point (or target function); the fuzzer then tracks which areas of the code are reached, and generates mutations on the corpus of input data in order to maximize the code coverage. The code coverage information for libFuzzer is provided by LLVM’s SanitizerCoverage instrumentation. LibFuzzer is still fully supported in that important bugs will get fixed. The first step in using libFuzzer on a library is to implement a fuzz target, a function that accepts an array of bytes and does something interesting with these bytes using the API under test. Note that this fuzz target does not depend on libFuzzer in any way so it is possible and even desirable to use it with other fuzzing engines like AFL and/or Radamsa.Starting Price: Free -
7
API Fuzzer
Fuzzapi
API Fuzzer allows to fuzz-request attributes using common pentesting techniques and lists vulnerabilities. API Fuzzer gem accepts an API request as input and returns vulnerabilities possible in the API. Cross-site scripting vulnerability, SQL injection, blind SQL injection, XML external entity vulnerability, IDOR, API rate limiting, open redirect vulnerabilities, information disclosure flaws, info leakage through headers, and cross-site request forgery vulnerability.Starting Price: Free -
8
Arch Linux
Arch Linux
Arch Linux is an independently developed, x86-64 general-purpose GNU/Linux distribution that strives to provide the latest stable versions of most software by following a rolling-release model. The default installation is a minimal base system, configured by the user to only add what is purposely required. Arch Linux defines simplicity as without unnecessary additions or modifications. It ships software as released by the original developers (upstream) with minimal distribution-specific (downstream) changes, patches not accepted by upstream are avoided, and Arch's downstream patches consist almost entirely of backported bug fixes that are obsoleted by the project's next release. Arch ships the configuration files provided by upstream with changes limited to distribution-specific issues like adjusting the system file paths. It does not add automation features such as enabling a service simply because the package was installed. -
9
Awesome Fuzzing
secfigo
Awesome Fuzzing is a list of fuzzing resources including books, courses, both free and paid, videos, tools, tutorials, and vulnerable applications to practice in order to learn fuzzing and initial phases of exploit development like root cause analysis. Courses/training videos on fuzzing, videos talking about fuzzing techniques, tools, and best practices. Conference talks and tutorials, blogs, tools that help in fuzzing applications, and fuzzers that help in fuzzing applications that use network-based protocols like HTTP, SSH, SMTP, etc. Search and pick the exploits, that have respective apps available for download, and reproduce the exploit by using the fuzzer of your choice. Set of tests for fuzzing engines. Includes different well-known bugs. A corpus, including various file formats for fuzzing multiple targets in the fuzzing literature.Starting Price: Free -
10
Honggfuzz
Google
Honggfuzz is a security-oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW-based). It’s multi-process and multi-threaded, there’s no need to run multiple copies of your fuzzer, as Honggfuzz can unlock the potential of all your available CPU cores with a single running instance. The file corpus is automatically shared and improved between all fuzzed processes. It’s blazingly fast when the persistent fuzzing mode is used. A simple/empty LLVMFuzzerTestOneInput function can be tested with up to 1mo iteration per second on a relatively modern CPU. Has a solid track record of uncovered security bugs, the only (to date) vulnerability in OpenSSL with the critical score mark was discovered by Honggfuzz. As opposed to other fuzzers, it will discover and report hijacked/ignored signals from crashes (intercepted and potentially hidden by a fuzzed program).Starting Price: Free -
11
syzkaller
Google
syzkaller is an unsupervised coverage-guided kernel fuzzer. Supports FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows. Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it's being extended to support other OS kernels as well. Once syzkaller detects a kernel crash in one of the VMs, it will automatically start the process of reproducing this crash. By default, it will use 4 VMs to reproduce the crash and then minimize the program that caused it. This may stop the fuzzing, since all of the VMs might be busy reproducing detected crashes. The process of reproducing one crash may take from a few minutes up to an hour depending on whether the crash is easily reproducible or non-reproducible at all.Starting Price: Free -
12
go-fuzz
dvyukov
Go-fuzz is a coverage-guided fuzzing solution for testing Go packages. Fuzzing is mainly applicable to packages that parse complex inputs (both text and binary) and is especially useful for hardening systems that parse inputs from potentially malicious users (anything accepted over a network). go-fuzz has recently added preliminary support for fuzzing Go Modules. If you encounter a problem with modules, please file an issue with details. Data is a random input generated by go-fuzz, note that in most cases it is invalid. The function must return 1 if the fuzzer should increase the priority of the given input during subsequent fuzzing if the input must not be added to the corpus even if it gives new coverage, and 0 otherwise; other values are reserved for future use. The fuzz function must be in a package that go-fuzz can import. This means the code you want to test can't be in package main. Fuzzing internal packages is supported, however.Starting Price: Free -
13
american fuzzy lop
Google
American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labor or resource-intensive testing regimes down the road. Compared to other instrumented fuzzers, afl-fuzz is designed to be practical, it has a modest performance overhead, uses a variety of highly effective fuzzing strategies and effort minimization tricks, requires essentially no configuration, and seamlessly handles complex, real-world use cases, say, common image parsing or file compression libraries. It's an instrumentation-guided genetic fuzzer capable of synthesizing complex file semantics in a wide range of non-trivial targets.Starting Price: Free -
14
Boofuzz
Boofuzz
Boofuzz is a fork of and the successor to the venerable Sulley fuzzing framework. Besides numerous bug fixes, Boofuzz aims for extensibility. Like Sulley, Boofuzzincorporates all the critical elements of a fuzzer like easy and quick data generation, instrumentation and failure detection, target reset after failure, and recording of test data. Much easier install experience and support for arbitrary communications mediums. Built-in support for serial fuzzing, ethernet- and IP-layer, UDP broadcast. Better recording of test data, consistent, thorough, and clear. Test result CSV export and extensible instrumentation/failure detection. Boofuzz installs as a Python library used to build fuzzer scripts. It is strongly recommended to set up Boofuzz in a virtual environment.Starting Price: Free -
15
Peach Fuzzer
Peach Tech
Peach is a SmartFuzzer that is capable of performing both generation and mutation-based fuzzing. Peach requires the creation of Peach Pit files that define the structure, type information, and relationships in the data to be fuzzed. It additionally allows for the configuration of a fuzzing run including selecting a data transport (publisher), logging interface, etc. Peach has been under active development since 2004 and is in its third major version. Fuzzing continues to be the fastest way to find security issues and test for bugs. Effective hardware fuzzing with Peach will introduce students to the fundamentals of device fuzzing. Peach was designed to fuzz any type of data consumer from servers to embedded devices. Researchers, corporations, and governments already use Peach to find vulnerabilities in hardware. This course will focus on using Peach to target embedded devices and collect information from the device in the event of a crash.Starting Price: Free -
16
Sulley
OpenRCE
Sulley is a fuzzing engine and fuzz testing framework consisting of multiple extensible components. Sulley (IMHO) exceeds the capabilities of most previously published fuzzing technologies, commercial and public domain. The goal of the framework is to simplify not only data representation but to simplify data transmission and instrumentation. A pure-Python fully automated and unattended fuzzing framework. Sulley not only has impressive data generation but has taken this a step further and includes many other important aspects a modern fuzzer should provide. Sulley watches the network and methodically maintains records. Sulley instruments and monitors the health of the target, capable of reverting to a known good state using multiple methods. Sulley detects, tracks, and categorizes detected faults. Sulley can fuzz in parallel, significantly increasing test speed. Sulley can automatically determine what unique sequence of test cases triggers faults.Starting Price: Free -
17
Fuzzapi
Fuzzapi
Fuzzapi is a tool used for REST API pentesting and uses API Fuzzer and provides UI solutions for gem.Starting Price: Free -
18
BFuzz
RootUp
BFuzz is an input-based fuzzer tool that takes HTML as an input, opens up your browser with a new instance, and passes multiple test cases generated by domato which is present in the recurve folder of BFuzz, more over BFuzz is an automation that performs the same task repeatedly and it doesn't mangle any test cases. Running BFuzz will ask for the option of whether to fuzz Chrome or Firefox, however, this will open Firefox from recurve and create the logs on the terminal. BFuzz is a small script that enables you to open the browser and run test cases. The test cases in recurve are generated by the domato generator and contain the main script. It contains additional helper code for DOM fuzzing.Starting Price: Free -
19
OWASP WSFuzzer
OWASP
Fuzz testing or fuzzing is a software testing technique, that basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion. Let’s consider an integer in a program, which stores the result of a user’s choice between 3 questions. When the user picks one, the choice will be 0, 1, or 2, which makes three practical cases. Integers are stored as a static size variable. If the default switch case hasn’t been implemented securely, the program may crash and lead to “classical” security issues. Fuzzing is the art of automatic bug finding, and its role is to find software implementation faults and identify them if possible. A fuzzer is a program that automatically injects semi-random data into a program/stack and detects bugs. The data-generation part is made of generators, and vulnerability identification relies on debugging tools. Generators usually use combinations of static fuzzing vectors. -
20
Jazzer
Code Intelligence
Jazzer is a coverage-guided, in-process fuzzer for the JVM platform developed by Code Intelligence. It is based on libFuzzer and brings many of its instrumentation-powered mutation features to the JVM. You can use Docker to try out Jazzer's autofuzz mode, which automatically generates arguments to a given Java function and reports unexpected exceptions and detected security issues. You can also use GitHub release archives to run a standalone Jazzer binary that starts its own JVM configured for fuzzing.Starting Price: Free -
21
ToothPicker
Secure Mobile Networking Lab
ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically target iOS's Bluetooth daemon and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This repository also includes an over-the-air fuzzer with an exemplary implementation to fuzz Apple's MagicPairing protocol using InternalBlue. Additionally, it contains the ReplayCrashFile script that can be used to verify crashes the in-process fuzzer has found. This is a very simple fuzzer that only flips bits and bytes of inactive connections. No coverage, no injection, but nice as a demo and stateful. Runs just with Python and Frida, no modules or installation are required. ToothPicker is built on the codebase of frizzer. It is recommended to set up a virtual Python environment for frizzer. Starting from the iPhone XR/Xs, PAC has been introduced.Starting Price: Free -
22
Arch
Arch Insurance Group
Arch’s experienced underwriting team takes a forward looking approach to writing network security, privacy and media liability. The Arch Netsafe® 2.0 Policy ensures that its coverage offerings are able to evolve and address the new exposures that spawn from an increasingly technology dependent society. Pursuing Better Together encapsulates how we do business at Arch Insurance. It is an approach that is based on collaboration, responsiveness and a genuine commitment to continually raising the bar. -
23
Radamsa
Aki Helin
Radamsa is a test case generator for robustness testing or fuzzer. It is typically used to test how well a program can withstand malformed and potentially malicious inputs. It works by reading sample files of valid data and generating interestingly different outputs from them. The main selling points of Radamsa are that it has already found a slew of bugs in programs that actually matter, it is easily scriptable, and, easy to get up and running. Fuzzing is one of the techniques to find unexpected behavior in programs. The idea is simply to subject the program to various kinds of inputs and see what happens. There are two parts to this process: getting the various kinds of inputs and how to see what happens. Radamsa is a solution to the first part, and the second part is typically a short shell script. Testers usually have a more or less vague idea of what should not happen, and they try to find out if this is so.Starting Price: Free -
24
Google OSS-Fuzz
Google
OSS-Fuzz offers continuous fuzzing for open source software. Fuzz testing is a well-known technique for uncovering programming errors in software. Many of these detectable errors, like buffer overflow, can have serious security implications. Google has found thousands of security vulnerabilities and stability bugs by deploying guided in-process fuzzing of Chrome components, and we now want to share that service with the open source community. OSS-Fuzz aims to make common open source software more secure and stable by combining modern fuzzing techniques with scalable, distributed execution. Projects that do not qualify for OSS-Fuzz can run their own instances of ClusterFuzz or ClusterFuzzLite. Currently, OSS-Fuzz supports C/C++, Rust, Go, Python, and Java/JVM code. Other languages supported by LLVM may work too. OSS-Fuzz supports fuzzing x86_64 and i386 builds.Starting Price: Free -
25
Fuzzing Project
Fuzzing Project
Fuzzing is a powerful strategy to find bugs in software. The idea is quite simple, which is to generate a large number of randomly malformed inputs for the software to parse and see what happens. If the program crashes then something is likely wrong. While fuzzing is a well-known strategy, it is surprisingly easy to find bugs, often with security implications, in widely used software. Memory access errors are the errors most likely to be exposed when fuzzing software that is written in C/C++. While they differ in the details, the core problem is often the same, the software reads or writes to the wrong memory locations. A modern Linux or BSD system ships a large number of basic tools that do some kind of file displaying and parsing. In their current state, most of these tools are not suitable for untrusted inputs. On the other hand, we have powerful tools these days that allow us to find and analyze these bugs.Starting Price: Free -
26
Wapiti
Wapiti
Wapiti is a web application vulnerability scanner. Wapiti allows you to audit the security of your websites or web applications. It performs "black-box" scans (it does not study the source code) of the web application by crawling the webpages of the deployed web app, looking for scripts and forms where it can inject data. Once it gets the list of URLs, forms, and their inputs, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable. Search for potentially dangerous files on the server. Wapiti supports both GET and POST HTTP methods for attacks. It also supports multipart forms and can inject payloads in filenames (upload). Warnings are raised when an anomaly is found (for example 500 errors and timeouts). Wapiti is able to make the difference between permanent and reflected XSS vulnerabilities. Generates vulnerability reports in various formats (HTML, XML, JSON, TXT, CSV).Starting Price: Free -
27
Arch
Arch
Arch is an intelligent gateway designed to protect, observe, and personalize AI agents through seamless integration with your APIs. Built on Envoy Proxy, Arch offers secure handling, intelligent routing, robust observability, and integration with backend systems, all external to business logic. It features an out-of-process architecture compatible with various application languages, enabling quick deployment and transparent upgrades. Engineered with specialized sub-billion parameter Large Language Models (LLMs), Arch excels in critical prompt-related tasks such as function calling for API personalization, prompt guards to prevent toxic or jailbreak prompts, and intent-drift detection to enhance retrieval accuracy and response efficiency. Arch extends Envoy's cluster subsystem to manage upstream connections to LLMs, providing resilient AI application development. It also serves as an edge gateway for AI applications, offering TLS termination, rate limiting, and prompt-based routing.Starting Price: Free -
28
ArchAdministrator
PS Software Solutions
ArchAdministrator has harnessed the power of the multi-layered relational database to simplify the task of recording, organizing, and analyzing the wide variety of data generated by your architectural or engineering practice. With more than eighty releases since its introduction in 1997, ArchAdministrator continues to establish itself as the standard against which all office and project management software will be measured and offers one of the most comprehensive ERP solutions for architects and engineers currently on the market. ArchAdministrator has garnered praise from the A/E community and maintains a competitive lead in its technical innovation, seamless integration, and user-friendly design. ArchAdministrator’s Accounting module simplifies the task of recording, organizing and analyzing accounts and accounting transactions. Predesigned charts, graphs, tables and summary reports will organize accounting data into meaningful information.Starting Price: $395 one-time payment -
29
Arch
Arch
Manage new investments, updates, taxes, capital calls, distributions & financial statements all in one place, seamlessly. Arch connects with the back office for each private investment, receiving all documents and communications in a secure, aggregated platform. Arch keeps your account up to date, adding a layer of automation to investment management tasks. Arch manages all documents and communications, providing better organization, data, and insights for private investments. Securely share all investment updates and investor information in an easy-to-use, standardized, and efficient platform, saving funds' and fund admins' time, while providing a better experience for the fund and its investors. Track the completion of key tasks and automatically follow up with investors, reducing firm time spent on administrative tasks. -
30
Solidity Fuzzing Boilerplate
patrickd
Solidity Fuzzing Boilerplate is a template repository intended to ease fuzzing components of Solidity projects, especially libraries. Write tests once and run them with both Echidna and Foundry's fuzzing. Fuzz components that use incompatible Solidity versions by deploying those into a Ganache instance via Etheno. Use HEVM's FFI cheat code to generate complex fuzzing inputs or to compare outputs with non-EVM executables while doing differential fuzzing. Publish your fuzzing experiments without worrying about licensing by extending the shell script to download specific files. Turn off FFI if you don't intend to make use of shell commands from your Solidity contracts. Note that FFI is slow and should only be used as a workaround. It can be useful for testing against things that are difficult to implement within Solidity and already exist in other languages. Before executing tests of a project that has FFI enabled, be sure to check what commands are actually being executed.Starting Price: Free -
31
Echidna
Crytic
Echidna is a Haskell program designed for fuzzing/property-based testing of Ethereum smart contracts. It uses sophisticated grammar-based fuzzing campaigns based on a contract ABI to falsify user-defined predicates or Solidity assertions. We designed Echidna with modularity in mind, so it can be easily extended to include new mutations or test specific contracts in specific cases. Generates inputs tailored to your actual code. Optional corpus collection, mutation and coverage guidance to find deeper bugs. Powered by Slither to extract useful information before the fuzzing campaign. Source code integration to identify which lines are covered after the fuzzing campaign. Interactive terminal UI, text-only or JSON output. Automatic test case minimization for quick triage. Seamless integration into the development workflow. Maximum gas usage reporting of the fuzzing campaign. Support for a complex contract initialization with Etheno and Truffle.Starting Price: Free -
32
Fuzzbuzz
Fuzzbuzz
The Fuzzbuzz workflow is very similar to other CI/CD testing workflows. However, unlike other testing workflows, fuzz testing requires multiple jobs to run simultaneously, which results in a few extra steps. Fuzzbuzz is a fuzz testing platform. We make it trivial for developers to add fuzz tests to their code and run them in CI/CD, helping them catch critical bugs and vulnerabilities before they hit production. Fuzzbuzz completely integrates into your environment, following you from the terminal to CI/CD. Write a fuzz test in your environment and use your own IDE, terminal, or build tools. Push to CI/CD and Fuzzbuzz will automatically start running your fuzz tests against your latest code changes. Get notified when bugs are found through Slack, GitHub, or email. Catch regressions as new changes are automatically tested and compared to previous runs. Code is built and instrumented by Fuzzbuzz as soon as a change is detected.Starting Price: Free -
33
feh
feh
feh is an X11 image viewer aimed mostly at console users. Unlike most other viewers, it does not have a fancy GUI, but simply displays images. It is controlled via command line arguments and configurable key/mouse actions. Slideshow: Show all files in or below a directory, change slides with your keyboard or automatically after a delay. feh is also shipped by many Linux/BSD distributions, including Arch Linux, Debian, FreeBSD, OpenBSD and Ubuntu. -
34
Arch
Arch
Stop wasting time managing your own integrations or fighting the limitations of black-box "solutions". Instantly use data from any source in your app, in the format that works best for you. 500+ API & DB sources, connector SDK, OAuth flows, flexible data models, instant vector embeddings, managed transactional & analytical storage, and instant SQL, REST & GraphQL APIs. Arch lets you build AI-powered features on top of your customer’s data without having to worry about building and maintaining bespoke data infrastructure just to reliably access that data.Starting Price: $0.75 per compute hour -
35
Black Duck
Black Duck
Black Duck, part of the Synopsys Software Integrity Group, is a leading provider of application security testing (AST) solutions. Their comprehensive portfolio includes tools for static analysis, software composition analysis (SCA), dynamic analysis, and interactive analysis, enabling organizations to identify and mitigate security vulnerabilities throughout the software development life cycle. By automating the discovery and management of open-source software, Black Duck ensures compliance with security and licensing standards. Their solutions are designed to help organizations build trust in their software by managing application security, quality, and compliance risks at the speed their business demands. Black Duck empowers businesses to innovate securely and deliver software with confidence. -
36
CI Fuzz
Code Intelligence
CI Fuzz ensures robust and secure code with test coverage up to 100%. Use CI Fuzz from the command line or in the IDE of choice to generate thousands of test cases automatically. CI Fuzz analyzes code as it runs, just like a unit test, but with AI support to efficiently cover all paths through the code. Uncover real bugs in real-time and say goodbye to theoretical issues and false positives. Find real issues with all the information needed to quickly reproduce and fix them. Test your code with maximum code coverage and automatically detect typical security-relevant bugs like injections and remote code executions automatically in one go. Get fully covered to deliver the highest quality software. Conduct real-time code analysis with CI Fuzz. Take unit tests to the next level. It employs AI for comprehensive code path coverage and the automatic generation of thousands of test cases. Maximize pipeline performance that doesn't compromise software integrity.Starting Price: €30 per month -
37
APIFuzzer
PyPI
APIFuzzer reads your API description and step-by-step fuzzes the fields to validate if your application can cope with the fuzzed parameters, and it does not require coding. Parse API definition from a local file or remote URL. JSON and YAML file format support. All HTTP methods are supported. Fuzzing of the request body, query string, path parameter, and request header is supported. Relies on random mutations and supports CI integration. Generate JUnit XML test report format. Send a request to an alternative URL. Support HTTP basic auth from the configuration. Save the report of the failed test in JSON format into the pre-configured folder.Starting Price: Free -
38
Mayhem
ForAllSecure
Advanced fuzzing solution that combines guided fuzzing with symbolic execution, a patented technology from CMU. Mayhem is an advanced fuzz testing solution that dramatically reduces manual testing efforts with autonomous defect detection and validation. Deliver safe, secure, reliable software with less time, cost, and effort. Mayhem’s unique advantage is in its ability to acquire intelligence of its targets over time. As Mayhem’s knowledge grows, it deepens its analysis and maximizes its code coverage. All reported vulnerabilities are exploitable, confirmed risks. Mayhem guides remediation efforts with in-depth system level information, such as backtraces, memory logs, and register state, expediting issue diagnosis and fixes. Mayhem utilizes target feedback to custom generate test cases on the fly -- meaning no manual test case generation required. Mayhem offers access to all of its test cases to make regression testing effortless and continuous. -
39
afl-unicorn
Battelle
afl-unicorn lets you fuzz any piece of binary that can be emulated by Unicorn Engine. If you can emulate the code you’re interested in using the Unicorn Engine, you can fuzz it with afl-unicorn. Unicorn Mode works by implementing the block-edge instrumentation that AFL’s QEMU mode normally does into Unicorn Engine. Basically, AFL will use block coverage information from any emulated code snippet to drive its input generation. The whole idea revolves around the proper construction of a Unicorn-based test harness. The Unicorn-based test harness loads the target code, sets up the initial state, and loads in data mutated by AFL from disk. The test harness then emulates the target binary code, and if it detects that a crash or error occurred it throws a signal. AFL will do all its normal stuff, but it’s actually fuzzing the emulated target binary code. Only tested on Ubuntu 16.04 LTS, but it should work smoothly with any OS capable of running both AFL and Unicorn.Starting Price: Free -
40
FuzzDB
FuzzDB
FuzzDB was created to increase the likelihood of finding application security vulnerabilities through dynamic application security testing. It's the first and most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses. FuzzDB contains comprehensive lists of attack payload primitives for fault injection testing. These patterns, categorized by the attack and where appropriate platform type, are known to cause issues like OS command injection, directory listings, directory traversals, source exposure, file upload bypass, authentication bypass, XSS, HTTP header crlf injections, SQL injection, NoSQL injection, and more. For example, FuzzDB catalogs 56 patterns that can potentially be interpreted as a null byte and contains lists of commonly used methods and name-value pairs that trigger debug modes.Starting Price: Free -
41
Code Intelligence
Code Intelligence
Our platform uses various security techniques, including coverage-guided and feedback-based fuzz testing, to automatically generate millions of test cases that trigger hard-to-find bugs deep within your application. This white-box approach protects against edge cases and speeds up development. Advanced fuzzing engines generate inputs that maximize code coverage. Powerful bug detectors check for errors during code execution. Uncover true vulnerabilities only. Get the input and stack trace as proof, so you can reliably reproduce errors every time. AI white-box testing uses data from all previous test runs to continuously learn the inner-workings of your application, triggering security-critical bugs with increasingly high precision. -
42
ArchFX Platform
Arch Systems
The intelligent ArchFX platform, with the latest database, software, hardware, and AI solutions, is specifically designed to transform electronics assembly operations. Insights for tomorrow are here– today. Manufacturers can now accurately and efficiently forecast conditions and concerns and proactively respond. Our clients are revolutionizing manufacturing with immediate information and deep analysis that generates 30x ROI. See how the ArchFX platform is built to provide analytics and alerts. We mean every machine. Not from just some select vendors. Not just the machines with modern APIs. With our multi-faceted software and hardware connectors, we collect rich data from all machines on the line. From the newest pick-and-place machine to the assembly machines down the line. Machine data is instantly delivered to high performance, multi-threaded brokers. You get real-time dashboards and alerts fed by the normalized data of The ArchFX Broker. -
43
ArchCode
ArchCode
ArchCode is an advanced architectural software that leverages AI to simplify and interpret complex building codes and regional regulations in Spain. Users can ask technical questions, and the system analyzes, interprets, and provides clear answers by consulting a robust database of construction codes. Additionally, ArchCode offers document downloads, real-time code updates, and personalized assistance for architects, engineers, and construction professionals. Its intuitive design ensures quick navigation and precise results tailored to each project’s requirements, saving time and reducing errors. -
44
ArchCommander
MPL Software Studio
ArchCommander is a tool that helps you manage your archive files. It allows you to perform many operations without unpacking the entire archive file. And of course, you can unpack selected files or everything, and create brand new archives as well as add or remove files from existing archives (if they support modification). Unpacking and creating archives is also possible directly from the Finder, just select the files and use the context menu to select the operation. If you have an archive file created on an operating system that does not use Unicode you can open it in ArchCommander and select the right characters encoding for file names (available for arj, lha/lzh, zip, rar and tar archives). ArchCommander delivers its Quick Look plugin that allows you to display archive file content directly from the Finder, just hit a space bar. Performance improvement for operations with thousands of small files.Starting Price: $2.99 one-time payment -
45
Tayt
Crytic
Tayt is a StarkNet smart contract fuzzer. We recommend using a Python virtual environment. When starting you will see the properties to be checked and the external functions used to generate a sequence of transactions. Eventually, if a property is violated a call sequence will be presented with the order of functions to be called, the respective arguments passed, the caller address, and the events emitted. With Tayt, you can test a contract that deploys other contracts.Starting Price: Free -
46
Arch
Arch
Manage new investments, updates, taxes, capital calls, distributions & financial statements all in one place, seamlessly. Arch connects with the back office for each private investment, receiving all documents and communications in a secure, aggregated platform. Arch keeps your account up to date, adding a layer of automation to investment management tasks. View investment history and document library, including investment updates, account statements, tax documents, capital call notices, and distributions. Receive all of your investment communications in one secure portal. No more hunting down documents across the internet and different portals. Systematically update your information across your accounts if you move, change account ownership, or need to make changes for any reason. -
47
ArchFormation
ArchFormation
ArchFormation is a no-code platform that enables users to design and deploy AWS cloud infrastructure swiftly and efficiently. Through an intuitive drag-and-drop interface, users can construct infrastructure diagrams using a comprehensive library of AWS components. The platform then generates production-ready Terraform code, which can be exported to GitHub or downloaded directly, granting full ownership and flexibility. ArchFormation supports multi-environment configurations, integrates DevOps best practices, and ensures enterprise-level security, making it ideal for startups, developers, and organizations aiming to accelerate cloud adoption without vendor lock-in.Starting Price: $49/month -
48
Ffuf
Ffuf
Ffuf is a fast web fuzzer written in Go. You can also practice your Ffuf scans against a live host with different lessons and use cases either locally by using the Docker container or against the live-hosted version. Provides virtual host discovery (without DNS records). In order to tell Ffuf about different inputs to test out, a wordlist is needed. You can supply one or more wordlists on the command line, and in case you wish (or are using multiple wordlists) you can choose a custom keyword for them. You can supply Ffuf with multiple wordlists (remember to configure a custom keyword for them though). The first word of the first wordlist is tested against all the words from the second wordlist before moving along to test the second word in the first wordlist against all the words in the second wordlist. In short, all of the different combinations are tried out. There are quite a few different ways to customize the request.Starting Price: Free -
49
Arches AI
Arches AI
Arches AI provides tools to craft chatbots, train custom models, and generate AI-based media, all tailored to your unique needs. Deploy LLMs, stable diffusion models, and more with ease. An large language model (LLM) agent is a type of artificial intelligence that uses deep learning techniques and large data sets to understand, summarize, generate and predict new content. Arches AI works by turning your documents into what are called 'word embeddings'. These embeddings allow you to search by semantic meaning instead of by the exact language. This is incredibly useful when trying to understand unstructed text information, such as textbooks, documentation, and others. With strict security rules in place, your information is safe from hackers and other bad actors. All documents can be deleted through on the 'Files' page.Starting Price: $12.99 per month -
50
JobArch
Arca24
JobArch is a Recruiting Software developed for SMEs, Staffing agencies and recruitment companies of small sizes, that effectively enables to improve recruitment processes. It's available in 6 languages. JobArch offers: - Applicant Tracking System (ATS) based on Artificial Intelligence that makes, in a few seconds, an automatic pre-screening of candidates through the use of a specific semantic engine for the HR world, which allows matching between job offers and CVs. - Integrated Multiposting system with all major job portals and social networks. - Candidate database always consultable: within it you can search for profiles by job title and location, and download those of interest, saving them among your candidates. - Customizable Killer question and psycho-aptitude test to assess candidates - CRM solution to manage the relationship with the candidates and the clients (customer data, offices, contancts, activities, ecc.). - To build and customize a Career pageStarting Price: 20$ per month
