KissPeter / Apifuzzer
Licence: gpl-3.0
Fuzz test your application using your OpenAPI or Swagger API definition without coding
Stars: ✭ 101
Programming Languages
Projects that are alternatives of or similar to Apifuzzer
Dredd Example
Example application using Dredd and CI
Stars: ✭ 79 (-21.78%)
Mutual labels: swagger, openapi, api-blueprint
Dredd
Language-agnostic HTTP API Testing Tool
Stars: ✭ 3,770 (+3632.67%)
Mutual labels: swagger, openapi, api-blueprint
Spot
Spot is a concise, developer-friendly way to describe your API contract.
Stars: ✭ 230 (+127.72%)
Mutual labels: swagger, openapi, api-blueprint
Swurg
Parse OpenAPI documents into Burp Suite for automating OpenAPI-based APIs security assessments (approved by PortSwigger for inclusion in their official BApp Store).
Stars: ✭ 94 (-6.93%)
Mutual labels: swagger, openapi
Connect Api Specification
This repository contains the OpenAPI specification as well as templates for generating SDKs for Square's APIs
Stars: ✭ 56 (-44.55%)
Mutual labels: swagger, openapi
Azure Rest Api Specs
The source for REST API specifications for Microsoft Azure.
Stars: ✭ 1,104 (+993.07%)
Mutual labels: swagger, openapi
Compojure Api
Sweet web apis with Compojure & Swagger
Stars: ✭ 1,056 (+945.54%)
Mutual labels: swagger, openapi
Openapi Spring Webflux Validator
🌱 A friendly kotlin library to validate API endpoints using an OpenApi 3.0 and Swagger 2.0 specification
Stars: ✭ 67 (-33.66%)
Mutual labels: swagger, openapi
Springdoc Openapi
Library for OpenAPI 3 with spring-boot
Stars: ✭ 1,113 (+1001.98%)
Mutual labels: swagger, openapi
Express Jsdoc Swagger
Swagger OpenAPI 3.x generator
Stars: ✭ 69 (-31.68%)
Mutual labels: swagger, openapi
Flask Restplus Server Example
Real-life RESTful server example on Flask-RESTplus
Stars: ✭ 1,240 (+1127.72%)
Mutual labels: swagger, openapi
Openapi Viewer
Browse and test a REST API described with the OpenAPI 3.0 Specification
Stars: ✭ 82 (-18.81%)
Mutual labels: swagger, openapi
Oav
Tools for validating OpenAPI (Swagger) files.
Stars: ✭ 55 (-45.54%)
Mutual labels: swagger, openapi
Intellij Swagger
A plugin to help you easily edit Swagger and OpenAPI specification files inside IntelliJ IDEA
Stars: ✭ 1,073 (+962.38%)
Mutual labels: swagger, openapi
Kaizen Openapi Editor
Eclipse Editor for the Swagger-OpenAPI Description Language
Stars: ✭ 97 (-3.96%)
Mutual labels: swagger, openapi
Swagger Jsdoc
Generates swagger/openapi specification based on jsDoc comments and YAML files.
Stars: ✭ 1,057 (+946.53%)
Mutual labels: swagger, openapi
Cats
Generate tests at runtime based on OpenApi specs
Stars: ✭ 86 (-14.85%)
Mutual labels: swagger, openapi
Paw Swaggerimporter
Swagger/OpenAPI 2.0 Importer for Paw
Stars: ✭ 34 (-66.34%)
Mutual labels: swagger, openapi
Molten Boilerplate
A boilerplate for the molten framework by Bogdanp https://github.com/Bogdanp/molten
Stars: ✭ 50 (-50.5%)
Mutual labels: swagger, openapi
APIFuzzer — HTTP API Testing Framework
APIFuzzer reads your API description and step by step fuzzes the fields to validate if you application can cope with the fuzzed parameters. Does not require coding.
APIFuzzer main features
- Parse API definition from local file or remote URL
- JSON and YAML file format support
- All HTTP methods are supported
- Fuzzing of request body, query string, path parameter and request header are supported
- Relies on random mutations
- Support CI integration
- Generate JUnit XML test report format
- Send request to alternative URL
- Support HTTP basic auth from configuration
- Save report of failed test in JSON format into the pre-configured folder
- Log to stdout instead of syslog
- Configurable log level
Supported API definition formats
Planned
Pre-requirements
- Python3
- sudo apt install libcurl4-openssl-dev libssl-dev libcurl4-nss-dev (on Ubuntu 18.04, required by pycurl)
- sudo apt install gcc libcurl4-nss-dev (on Ubuntu 20.04, required by pycurl)
Installation
Latest release version:
pip3 install APIFuzzer
Development version: Fetch the most recent code from GitHub
$ git clone https://github.com/KissPeter/APIFuzzer.git
Install requirements. If you don't have pip installed, then sudo apt-get install python3-pip -y
$ pip3 install -r APIFuzzer/requirements.txt
Quick Start
Check the help (some of them are not implemented yet):
$$ usage: APIFuzzer [-h] [-s SRC_FILE] [--src_url SRC_URL] [-r REPORT_DIR] [--level LEVEL] [-u ALTERNATE_URL] [-t TEST_RESULT_DST]
[--log {critical,fatal,error,warn,warning,info,debug,notset}] [--basic_output BASIC_OUTPUT] [--headers HEADERS] [-v ,--version]
APIFuzzer configuration
optional arguments:
-h, --help show this help message and exit
-s SRC_FILE, --src_file SRC_FILE
API definition file path. JSON and YAML format is supported
--src_url SRC_URL API definition url. JSON and YAML format is supported
-r REPORT_DIR, --report_dir REPORT_DIR
Directory where error reports will be saved. Default is temporally generated directory
--level LEVEL Test deepness: [1,2], the higher is the deeper (In progress)
-u ALTERNATE_URL, --url ALTERNATE_URL
Use CLI defined url instead compile the url from the API definition. Useful for testing
-t TEST_RESULT_DST, --test_report TEST_RESULT_DST
JUnit test result xml save path
--log {critical,fatal,error,warn,warning,info,debug,notset}
Use different log level than the default WARNING
--basic_output BASIC_OUTPUT
Use basic output for logging (useful if running in jenkins). Example --basic_output=True
--headers HEADERS Http request headers added to all request. Example: '[{"Authorization": "SuperSecret"}, {"Auth2": "asd"}]'
Usage example:
Start the sample application (install the necessary packages listed in test/requirements_for_test.txt):
$ python3 test/test_application.py
Start the fuzzer:
$ ./bin/APIFuzzer -s test/test_api/openapi_v2.json -u http://127.0.0.1:5000/ -r /tmp/reports/ --log debug
Check the reports:
$ ls -1 /tmp/reports/
Report example:
$ json_pp < /tmp/reports/79_1573993485.5391517.json
{
"response" : "Test application exception: invalid literal for int() with base 10: '0\\x00\\x10'",
"sub_reports" : [],
"parsed_status_code" : 500,
"state" : "COMPLETED",
"test_number" : 79,
"request_body" : null,
"reason" : "failed",
"name" : "target",
"request_url" : "http://127.0.0.1:5000/exception/0\u0000\u0010",
"request_method" : "GET",
"status" : "failed",
"request_headers" : "{\"User-Agent\": \"APIFuzzer\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept\": \"*/*\", \"Connection\": \"keep-alive\"}"
}
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].