Hsuan-Fuzz: REST API Fuzzing by Coverage Level Guided Blackbox Testing

Architecture

Usage

package main

import (
    restAPI "github.com/iasthc/hsuan-fuzz/pkg/rest-api"
)

func main() {
    x, err := restAPI.New("OpenAPI.yaml", ".", true, true)
    if err != nil {
        panic(err)
    }
    x.Fuzz(true)
}

Paper

• [English] REST API Fuzzing by Coverage Level Guided Blackbox Testing
• [中文] 基於黑箱覆蓋等級指引之 REST API 模糊測試

Bugs reported

• Spree, PR #10626
• Spree, Issue #10647
• Spree, Issue #10971
• Magento2, Issue #31551
• Magento2, Issue #32784

Credits

• Mutation strategy
  • dvyukov/go-fuzz
• Examples of OpenAPI parameter
  • danielgtaylor/apisprout