Best Fuzz Testing Tools for JSON

Etheno, the Ethereum-testing Swiss Army Knife. It's a JSON RPC wrapper, analysis tool multiplexer and test integration tool. It removes the complexity in setting up analysis tools such as Echidna for large, multi-contract project. Etheno is a great tool for smart contract developers to test their contracts. Etheno is a great tool for Ethereum client developers to test their implementations. Etheno is a JSON RPC Server that can multiplex requests to one or several clients. API for filtering, modifying and filtering JSON RPC calls. Sending JSON RPC to multiple Ethereum clients allows differential testing. Deploy and interact with multiple networks simultaneously. Integration with test frameworks such as Ganache and Truffle. Run a local network test with just one command. Use our Docker container pre-built to quickly install Etheno. Etheno is a flexible tool that can be used many different ways. There are therefore a number of command-line arguments.

The best tools are needed for hands-on security testers. You can use tools that you trust and enjoy all day. The tools that professionals trust. Burp Suite Professional is a web security tester's favorite toolkit. It can automate repetitive tasks and then dig deeper using its expertly designed manual and semi-automated testing tools. Burp Suite Professional will help you test for OWASP Top 10 vulnerabilities as well as the latest hacking techniques. Smart automation works in conjunction with expertly designed manual tools to save you time. Optimize your workflow and do more of what is best for you. Burp Scanner is able to navigate and scan JavaScript heavy single-page applications, scan APIs and prerecord complex authentication sequences. A toolkit used by professional testers. Use features such as the ability to record all you did during an engagement and the powerful search function to increase efficiency and reliability.

Ffuf, a web fuzzer in Go, is fast and easy to use. You can also practice Ffuf scanning against a live host using different lessons and use-cases either locally, by using the Docker Container or against the live hosted version. Virtual host discovery is provided (without DNS records). A wordlist is required to inform Ffuf of the different inputs that should be tested. You can specify one or more wordlists in the command line. If you wish to (or if you are using multiple wordlists), you can select a custom keyword. You can provide Ffuf multiple wordlists. Just remember to configure a keyword for each one. The first word from the first list is tested against the words of the second list before moving on to test the second. All combinations are tested. There are many different ways to customize your request.

APIFuzzer is a tool that reads your API description, and fuzzes each field step-by-step to determine if your application will be able to handle the fuzzed parameter. It does not require any coding. Parse API definitions from a remote URL or local file. Support for JSON and YAML files. All HTTP methods can be used. Support for fuzzing the request body, path parameter, query string and request header. Supports CI integration and relies on random mutations. Create JUnit XML format for test reports. Send a request using an alternative URL. Support HTTP basic authentication from the configuration. Save the JSON formatted report of the failed tests into the preconfigured folder.

Wapiti is an application vulnerability scanner. Wapiti is a web application vulnerability scanner that allows you to audit your website or web application's security. It crawls the pages of the deployed web application, looking for scripts or forms where it could inject data. Wapiti, once it has a list of URLs and forms, as well as their inputs (inputs), acts like a "fuzzer" by injecting payloads into a script to see if it is vulnerable. Search for potentially harmful files on the server. Wapiti can be used to launch attacks using both GET HTTP and POST methods. It can also inject payloads into filenames. When an anomaly is detected (for example, 500 errors and timeouts), warnings are raised. Wapiti can distinguish between reflected and permanent XSS vulnerabilities. Creates vulnerability reports in different formats (HTML XML JSON TXT CSV).

Echidna is a Haskell program designed for fuzzing/property-based testing of Ethereum smart contracts. It uses sophisticated grammar based fuzzing campaigns, based on an ABI contract, to falsify user defined predicates or Solidity statements. Echidna was designed with modularity in the mind. It can be easily expanded to include new mutations, or test specific contracts for specific cases. It generates inputs that are tailored to your code. Use optional corpus collection, mutation and guidance to find deeper bugs. Powered by Slither, to extract useful information prior to the fuzzing campaigns. Source code integration for identifying which lines have been covered after the fuzzing campaign. Interactive terminal UI with text-only output or JSON. Automatic test case minimization to speed up triage. Integration into the development workflow is seamless. Reporting of maximum gas usage during the fuzzing campaign. Support for the complex contract initialization process with Etheno, Truffle.