News for hackers. Stuff that matters.

A comment on Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI specification.

Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by matusf on Monday November 15, 2021 @02:52PM (#29231836)
Hi HN, I'd like to share with you a fuzzer I've been working on. It is a black-box, smart, generation-based fuzzer, that fuzzes APIs based on OpenAPI specification. It all started as a bachelor thesis[0], when I wanted to do something security-related and learn Rust along the way. My colleague @viralpoetry tutored me and so far, we've been able to find bugs in software such as k8s, gitea, and vault[1].

As for the choice of language, Rust proved to be a good decision, even though, one would think that dynamic languages are better suited for fuzzing (at least that was the choice for API fuzzers that I looked into). Thanks to Rust's type system, I was able to deserialize the OpenAPI specification to structs and traverse them when creating a fuzzing payload in a type-safe way. Other fuzzers load the specification to a dictionary/hashmap and then fail during the traversal because of some missing key they expected.

0: https://github.com/matusf/bachelor-thesis/releases/download/...

1: https://github.com/matusf/openapi-fuzzer#findings

[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by mch82 on Tuesday November 16, 2021 @01:47AM (#29237636)
Fuzzing: “Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program”

[Wikipedia]: https://en.m.wikipedia.org/wiki/Fuzzing

(Just in case others are looking for a definition, though I guess it must be relatively well known)

[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by anitil on Monday November 15, 2021 @06:20PM (#29234297)
Very impressive, particularly for an undergrad thesis! It's almost magical how quickly fuzzing can find bugs, even in mature software.
[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by jonahbenton on Monday November 15, 2021 @10:17PM (#29236344)
Fantastic, great to see. I was looking into this problem several years back and recall wanting more semantics than openapi provided to be able to drive fuzzing. Maybe you have a clever solution. Will check out the thesis. Cheers!
[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by djakaitis on Monday November 15, 2021 @06:48PM (#29234584)
Love this. Sad it’s GPL though.
[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by jacoblambda on Tuesday November 16, 2021 @06:53AM (#29239507)
Fun fact but there are very little hazards for GPL with testing software. Since it doesn't ship with the actual software it can be restricted to the source being distributed to the "users" of the tests which are the developers. If source must be provided to the contractor (in the case of say the US gov or a corporation), the tests only need be run in the view of a restricted set of individuals which allows them to receive the source but none of the standard users of the main, non-testing software.
[ Parent | on HN ]
Re:Show HN: OpenAPI fuzzer – fuzzing APIs based on OpenAPI s... by phantomathkg on Monday November 15, 2021 @07:40PM (#29235050)
Why so?
[ Parent | on HN ]