Skip to content
Fuzz your application using you Swagger or API Blueprint definition without coding
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
apifuzzer code quality fixes Sep 13, 2018
docs fix version string Sep 6, 2018
.editorconfig sample swagger definition and fuzzable application Jul 16, 2018
.gitignore imrovements on path fuzzing May 31, 2018
.travis.yml coverity wip Sep 10, 2018 Create Jan 30, 2018 code quality fixes Sep 13, 2018 code quality fix of fixes Sep 13, 2018
requirements.txt First version ready Jan 2, 2018

Join the chat at Codacy Badge CII Best Practices Build Status Maintainability Documentation Status Coverity Scan Build Status

APIFuzzer — HTTP API Testing Framework

APIFuzzer reads your API description and step by step fuzzes the fields to validate if you application can cope with the fuzzed parameters. Does not require coding.

Supported API Description Formats

Work in progress


Fetch the most recent code from GitHub

$ git clone

Install requirements. If you don't have pip installed, then sudo apt-get install python-pip -y

$ pip2.7 install -r APIFuzzer/requirements.txt

Quick Start

Check the help (some of them are not implemented yet):

$ python2.7 -h
usage: [-h] -s SRC_FILE [-r REPORT_DIR] [--level LEVEL]
                 [-u ALTERNATE_URL] [-t TEST_RESULT_DST]
                 [--log {warn,error,debug,info,warning,critical,notset}]

API fuzzer configuration

optional arguments:
  -h, --help        show this help message and exit
  -s SRC_FILE, --src_file SRC_FILE
                    API definition file path
  -r REPORT_DIR, --report_dir REPORT_DIR
                    Directory where error reports will be saved, default:
  --level LEVEL     Test deepness: [1,2], higher is the deeper !!!Not
                    Use CLI defined url instead compile the url from the API
                    definition. Useful for testing
                    JUnit test result xml save path !!!Not implemented!!!
  --log {warn,error,debug,info,warning,critical,notset}
                    Use different log level than the default WARNING

Usage example:

Start the sample application (install the necessary packages listed in test/requirements_for_test.txt):
$ python2.7 test/

Start the fuzzer:
$ python2.7 -s test/test_swagger_definition.json -u http://localhost:5000/ -r /tmp/reports/ 

Check the reports:
$ ls -1 /tmp/reports/
You can’t perform that action at this time.