Best Fuzz Testing Tools for Docker

Etheno, the Ethereum-testing Swiss Army Knife. It's a JSON RPC wrapper, analysis tool multiplexer and test integration tool. It removes the complexity in setting up analysis tools such as Echidna for large, multi-contract project. Etheno is a great tool for smart contract developers to test their contracts. Etheno is a great tool for Ethereum client developers to test their implementations. Etheno is a JSON RPC Server that can multiplex requests to one or several clients. API for filtering, modifying and filtering JSON RPC calls. Sending JSON RPC to multiple Ethereum clients allows differential testing. Deploy and interact with multiple networks simultaneously. Integration with test frameworks such as Ganache and Truffle. Run a local network test with just one command. Use our Docker container pre-built to quickly install Etheno. Etheno is a flexible tool that can be used many different ways. There are therefore a number of command-line arguments.

Ffuf, a web fuzzer in Go, is fast and easy to use. You can also practice Ffuf scanning against a live host using different lessons and use-cases either locally, by using the Docker Container or against the live hosted version. Virtual host discovery is provided (without DNS records). A wordlist is required to inform Ffuf of the different inputs that should be tested. You can specify one or more wordlists in the command line. If you wish to (or if you are using multiple wordlists), you can select a custom keyword. You can provide Ffuf multiple wordlists. Just remember to configure a keyword for each one. The first word from the first list is tested against the words of the second list before moving on to test the second. All combinations are tested. There are many different ways to customize your request.

Jazzer is an in-process, coverage-guided fuzzer developed by Code Intelligence for the JVM platform. It is based on libFuzzer and brings many of its instrumentation-powered mutation features to the JVM. Docker can be used to test Jazzer's autofuzz, which generates arguments for a Java function and reports unexpected errors and detected security issues. You can also run a standalone Jazzer binaries that starts its JVM configured for fuzzling using GitHub release archives.

Wfuzz is a framework for automating web application security assessments. It could help you secure web applications by finding web application vulnerabilities and exploiting them. You can also run the Wfuzz image from Docker. Wfuzz works on the simple principle that it replaces all references to the fuzz keyword by the value of the payload. In Wfuzz, a payload is a data source. This simple concept allows for any input to be injected into any field of an HTTP Request, allowing for complex web security attacks to be performed in different web application components, such as parameters and authentication, forms, directories/files or headers. Plugins are used to support Wfuzz's vulnerability scanner for web applications. Wfuzz's modular structure makes it easy to contribute, even for the newest Python programmers. The process of creating plugins is easy and takes only a few moments.

Echidna is a Haskell program designed for fuzzing/property-based testing of Ethereum smart contracts. It uses sophisticated grammar based fuzzing campaigns, based on an ABI contract, to falsify user defined predicates or Solidity statements. Echidna was designed with modularity in the mind. It can be easily expanded to include new mutations, or test specific contracts for specific cases. It generates inputs that are tailored to your code. Use optional corpus collection, mutation and guidance to find deeper bugs. Powered by Slither, to extract useful information prior to the fuzzing campaigns. Source code integration for identifying which lines have been covered after the fuzzing campaign. Interactive terminal UI with text-only output or JSON. Automatic test case minimization to speed up triage. Integration into the development workflow is seamless. Reporting of maximum gas usage during the fuzzing campaign. Support for the complex contract initialization process with Etheno, Truffle.

Our platform uses a variety of security techniques, including feedback-based fuzz testing and coverage-guided fuzz testing, in order to generate millions upon millions of test cases that trigger difficult-to-find bugs deep in your application. This white-box approach helps to prevent edge cases and speed up development. Advanced fuzzing engines produce inputs that maximize code coverage. Powerful bug detectors check for errors during code execution. Only uncover true vulnerabilities. You will need the stack trace and input to prove that you can reproduce errors reliably every time. AI white-box testing is based on data from all previous tests and can continuously learn the inner workings of your application. This allows you to trigger security-critical bugs with increasing precision.

Thousands of tests are generated automatically every minute in order to identify vulnerabilities and guide rapid remediation. Mayhem automates the generation of test suites to produce actionable results. Mayhem uses dockerized images, so there is no need to recompile code. Self-learning ML continuously runs thousands of tests every second, probing for defects and crashes. Developers can then focus on features. Continuous testing is run in the background, highlighting new defects and increasing code coverage. Mayhem provides a copy/paste replication and backtrace of every defect. It then prioritizes these based on the risk. All results are duplicated, and sorted by urgency. Mayhem integrates with your existing build pipelines and development tools to provide developers with actionable results. No matter what tools or language your team uses.

Advanced fuzzing solution that combines guided and symbolic execution. This technology is patented by CMU. Mayhem, an advanced fuzz testing solution, dramatically reduces manual testing with autonomous defect detection. You can deliver reliable, secure software in a shorter timeframe, at a lower cost, and with less effort. Mayhem's unique advantage lies in its ability to continuously acquire intelligence about its targets. Mayhem's knowledge increases and it expands its analysis. This allows it to maximize its code coverage. All vulnerabilities reported are exploitable and confirmed risks. Mayhem provides detailed system-level information such as backtraces, memory logs and register state to assist in remediation efforts. This helps speed up issue diagnosis and fixes. Mayhem uses target feedback to automatically generate test cases -- no need for manual testing. Mayhem provides access to all its test cases, making regression testing easy and continuous.

Defensics, a versatile, automated blackbox fuzzer, allows organizations to quickly and effectively identify and fix security flaws in software. Identify flaws and zero-day vulnerabilities in protocols and services. The generational fuzzer uses an intelligent, targeted approach for negative testing. Advanced protocol template and file fuzzers allow users to create their own test cases. The SDK allows experts to use the Defensics framework for their own test cases. Defensics can be run without the need for source code because it is a black-box fuzzer. Defensics allows users to secure their cyber supply chain and ensure interoperability, robustness and security of software and devices, before introducing them into IT and lab environments. Fuzzing techniques that are properly executed can be a cost-effective and efficient way to find vulnerabilities. They can cover more code paths and iterations than manual analysis.