Side by side
OSS-Fuzz vs Wfuzz
Both stand on fuzz testing software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Eligible open-source projects should consider OSS-Fuzz for distributed fuzzing and private bug alerts at no charge. Projects that do not qualify, including closed-source projects, can run their own ClusterFuzz or ClusterFuzzLite instances; accepted projects also need to work within the build and disk limits.
Visit OSS-FuzzChoose Wfuzz if you need a free, locally run framework for generating inputs across HTTP requests and assessing web applications. Its broad request coverage, scanner plugins, and payload tools are useful reasons to consider it. Look elsewhere if you need a service that does not run locally or a license other than GPL-2.0.
Visit WfuzzThe facts
| OSS-Fuzz | Wfuzz | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Web | Linux, Mac, Self-hosted, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | google.github.io | github.com |
| On fuzz testing software | #17 of 26 | #13 of 26 |
OSS-Fuzz: what it does well
- Free service for accepted open-source projects.
- Supports seven listed programming languages.
- Combines fuzzing engines with sanitizers.
- Provides private alerts about detected bugs.
- Supports CI/CD and crash triage.
What to know first
- Acceptance requires an open-source project meeting stated criteria.
- Builds are limited to four per day.
- Builder disk usage must stay below 250 GB.
- Full ClusterFuzz access requires a Google account.
Wfuzz: what it does well
- FUZZ markers can supply payload values across many HTTP request components.
- Payloads can be combined, encoded, and filtered against responses.
- A plugin-supported vulnerability scanner is included.
- The modular framework allows users to build plugins.
- Installation options include pip and a Docker image.
What to know first
- Wfuzz executes locally.
- The project is licensed under GPL-2.0.
Alternatives to OSS-Fuzz Alternatives to Wfuzz The whole list