API Fuzzer

Overview

Perform API fuzzing to discover crashes, unhandled exceptions, security vulnerabilities, and edge case failures by sending malformed, unexpected, and boundary-value inputs to API endpoints. Supports RESTler (stateful REST API fuzzing), Schemathesis (OpenAPI-driven property-based testing), custom fuzz harnesses with fast-check, and OWASP ZAP active scanning.

Prerequisites

• API specification available (OpenAPI/Swagger, GraphQL SDL, or Protobuf definitions)
• Target API running in a test environment (never fuzz production)
• Fuzzing tool installed (Schemathesis, RESTler, or custom harness with fast-check/Hypothesis)
• API authentication credentials for protected endpoints
• Error logging enabled on the target server to capture crashes and stack traces

Instructions

1. Parse the API specification to identify all endpoints, methods, and input schemas:

• Read OpenAPI spec files using Glob (/openapi.yaml, /swagger.json).
• Catalog each endpoint's parameters (path, query, header, body) and their types.
• Note validation constraints (min/max, pattern, enum, required fields).

1. Configure the fuzzing strategy:

• Schema-based: Generate inputs that violate schema constraints (wrong types, missing fields, extra fields).
• Mutation-based: Start with valid requests and mutate individual fields (bit flips, boundary values, special characters).
• Dictionary-based: Use known problematic inputs (SQL injection, XSS payloads, format strings, null bytes).

1. Define fuzz input categories for each parameter type:

• Strings: Empty, very long (10K+ chars), unicode, null bytes, format strings (%s%n), path traversal (../../etc/passwd).
• Numbers: 0, -1, MAXINT, MININT, NaN, Infinity, floats where ints expected.
• Arrays: Empty, single element, thousands of elements, nested arrays, mixed types.
• Objects: Empty, missing required fields, extra unknown fields, deeply nested (100+ levels).
• Dates: Invalid formats, epoch zero, far future, negative timestamps.

1. Execute the fuzzing campaign:

• Run Schemathesis: schemathesis run http://localhost:3000/openapi.json --stateful=links.
• Or run RESTler: restler-fuzzer fuzz --grammar_file grammar.py.
• Or write custom fuzz tests with fast-check/Hypothesis for targeted endpoints.
• Set a time budget (30-60 minutes for initial run).

1. Analyze findings:

• 5xx responses: Unhandled server errors -- file as bugs.
• Crashes/hangs<