- Home
- API Security Testing Software
- WuppieFuzz
WuppieFuzz
What it is
WuppieFuzz is a free, open-source REST API fuzzer built on LibAFL that uses coverage-guided testing to look for potential errors and security flaws. It generates and mutates requests from an OpenAPI specification and supports black-box, grey-box, and white-box testing. Authentication documentation covers Bearer, custom, cookie, OAuth, and Web Fuzzing Commons formats. The tool can produce endpoint coverage reports, and code coverage is supported for Java, JavaScript, and Python; code coverage reports are currently limited to JaCoCo. A Grafana dashboard can display and explore request information collected during a fuzzing campaign. WuppieFuzz is self-hosted and runs on Windows, macOS, and Linux. TNO says fuzzing data is not shared with it or third parties, and the project is released under the Apache 2.0 license. TNO describes the tool as suitable for a broad audience, including use in software development, supply-chain quality control, or penetration testing. It does not offer API discovery, so users need an OpenAPI specification to generate and mutate requests.
For and against
For
- Supports black-box, grey-box, and white-box testing.
- Tests authentication and input validation.
- Runs self-hosted on Windows, macOS, and Linux.
- TNO says fuzzing data is not shared with third parties.
Against
- Requires an OpenAPI specification for request generation.
- Does not provide API discovery.
- Code coverage reports are currently limited to JaCoCo.
The verdict
WuppieFuzz offers self-hosted REST API fuzzing with multiple testing modes and authentication formats. Its dependence on OpenAPI specifications and JaCoCo-only code coverage reporting are important scope limits.
Who it suits
WuppieFuzz may suit development, security, or quality-control teams that have OpenAPI specifications and want to fuzz REST APIs in a self-hosted environment. Its documented use cases also include penetration testing.
Plans and prices
WuppieFuzz Free
Open-source REST API fuzzer · self-hosted · Apache-2.0
Read 15 Oct 2026 · tno.nl
WuppieFuzz
Free, open source REST API fuzzer
Read 8 Oct 2026 · tno.nl
On the record
- API specification
- It requires an OpenAPI specification to generate and mutate requests.github.com · read 8 Oct 2026
- Audience and uses
- TNO describes the tool as intended for a broad audience and usable during software development, supply-chain quality control, or penetration testing.tno.nl · read 8 Oct 2026
- Authentication
- Authentication documentation describes Bearer, custom, cookie, OAuth, and Web Fuzzing Commons formats.github.com · read 8 Oct 2026
- Automated harness
- The tool automates creation of the HTTP fuzzing harness, reducing manual setup work.arxiv.org · read 15 Oct 2026
- Black-box fallback
- Black-box testing remains available without a coverage agent, but provides less detailed feedback than line coverage.researchgate.net · read 15 Oct 2026
- CLI and configuration
- The command-line interface accepts an OpenAPI file, and YAML configuration files can be combined with command-line flags, with flags taking precedence.github.com · read 15 Oct 2026
- Code coverage
- The maker says code coverage is supported for Java, JavaScript, and Python, and that adding languages is possible.tno.nl · read 8 Oct 2026
- Coverage agents
- The research describes coverage agents for Java, Python and JavaScript, with a modular design intended to allow more languages.researchgate.net · read 15 Oct 2026
- Coverage feedback
- Scheduling can use code coverage and endpoint coverage gathered through coverage agents.researchgate.net · read 15 Oct 2026
- Dashboard
- A Grafana dashboard is supplied to visualize and explore fuzzing results.github.com · read 15 Oct 2026
- Developer prerequisites
- Building from source requires build-essential, pkg-config, CMake and Rust, with OpenSSL, SQLite and Z3 system-library options documented.github.com · read 15 Oct 2026
- Docker
- The project documents building a Docker image and running it with a mounted fuzzing directory and host networking for local targets.github.com · read 15 Oct 2026
- Documentation depth
- The repository includes a low-level tutorial, example configurations, coverage-agent instructions and generated Rust API documentation support.github.com · read 15 Oct 2026
- Extensibility
- The project invites contributions such as new language coverage agents and mutation techniques.tno.nl · read 15 Oct 2026
- Independent registry status
- The Dutch open-source registry marks the repository status as stable and lists Linux, macOS and Windows platforms.oss.developer.overheid.nl · read 15 Oct 2026
- Independent technical description
- An ETSI workshop presentation characterizes WuppieFuzz as an open-source, LibAFL-based coverage-guided REST API fuzzer using OpenAPI response conformance and endpoint coverage.docbox.etsi.org · read 15 Oct 2026
- Install platforms
- The README points users to releases or Homebrew for macOS, Windows and Linux installation.github.com · read 15 Oct 2026
- Latest repository release
- The GitHub repository page currently presents WuppieFuzz v1.8.0.github.com · read 15 Oct 2026
