Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

github.com

Post reply on HN
Print view View original

21–25 of 25 posts

Re: Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

#21

Post by tbarn »

nerdponx wrote: post #18
matusf wrote: post #15

Earlier quoted context omitted.

No, it does not. As for the parsing of the OAS, it relies on openapiv3[0], which does not yet support it. 0: https://github.com/glademiller/openapiv3

That's too bad. It's starting to feel like 3.1 is never going to gain adoption unless we get entirely new tools built for it.

I'm less worried about 3.1 as I was with 3.0. It took years (like more than three) for the move from 2 to 3, and still there's a couple of popular tools that still haven't fully supported 3.0 yet.

Re: Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

#22

Post by spuz »

I've just managed to get this set up with an API but it appears to get stuck testing only one of the endpoints. For example, if I set it up to test an endpoint with a query param like so:

> /search?q=?

Then it seems to try every single value for q it can think of (there are quite a few different possible strings) without ever moving onto the next endpoint. Is there anyway to configure its behaviour or provide hints as to what kind of fuzzing to do?

Re: Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

#23

Post by matusf »

spuz wrote: post #22

I've just managed to get this set up with an API but it appears to get stuck testing only one of the endpoints. For example, if I set it up to test an endpoint with a query param like so: > /search?q=? Then it seems to try every single value for q it can think of (there are quite a few different possible strings) without ever moving onto the next endpoint. Is there anyway to configure its behaviour or provide hints a…

Thanks for the report. However, without more information I'm not able to help you. What is your setup? How did you run it? could you please share the specification file? Also, let's probably move this discussion to GitHub issues: https://github.com/matusf/openapi-fuzzer/issues

Re: Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

#24

Post by yellow_lead »

matusf wrote: post #20
yellow_lead wrote: post #12

There's another one here by Microsoft - this is cool though! great to see more Rust tools. https://github.com/microsoft/restler-fuzzer

Yes, we looked into it. There is a chapter in my thesis[0] about RESTler and comparison with OpenAPI fuzzer. The main difference between those two fuzzer is that RESTler is a statefull fuzzer and OpenAPI fuzzer is a stateless fuzzer. Thanks to being statefull, RESTler is able to analyze a dependencies between a requests. For example, it will not call and endpoint to get user details before calling endpoint to create…

Thanks for the reply! Nice to know those differences, I will definitely try your project on a spec in the future.

Re: Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification

#25

Post by solarmist »

pgjones wrote: post #17
solarmist wrote: post #7

This is fantastic! I was a just looking for a fuzzer for OpenAPI stuff. I'm building a project with FastAPI that I'd love to try this on.

You can already do this using Hypothesis with the Pydantic plugin, https://pydantic-docs.helpmanual.io/hypothesis_plugin/ . Here is an example for Quart-Schema (similar setup to FastAPI) https://pgjones.dev/blog/automatic-api-testing-2021 .

Excellent! It's always nice to find useful tools you didn't know about.
Post reply on HN