Skip to content

Commit ad4ed35

Browse files
en-milieen-milie
committed
chore: Update documentation with latest fuzzers and arguments
1 parent 109793c commit ad4ed35

File tree

10 files changed

+99
-13
lines changed

10 files changed

+99
-13
lines changed

‎docs/commands-and-arguments/arguments.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ You can get the full list of arguments by running `cats -h`. Below is a short de
5858
- `--ignoreResponseWords` COUNT_LIST a comma separated list of words count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
5959
- `--ignoreResponseLines` LINES_COUNT a comma separated list of lines count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
6060
- `--ignoreResponseRegex` a REGEX that will match against the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
61+
- `--ignoreErrorLeaksCheck`If supplied (no value needed) it won't check if the response body contains sensitive information and will return the test result as SUCCESS instead of ERROR
6162
- `--filterResponseCodes` HTTP_CODES_LIST a comma separated list of HTTP response codes that will be filtered and not included in the final report. You can use response code families as `2xx`, `4xx`, etc.
6263
- `--filterResponseSize` SIZE_LIST a comma separated list of response sizes that will be filtered and not included in the final report
6364
- `--filterResponseWords` COUNT_LIST a comma separated list of words count in the response that will be filtered and not included in the final report

‎docs/fuzzers/field-fuzzers/index.md‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Field Fuzzers
22

3-
CATS has currently 60 registered `Field` Fuzzers:
3+
CATS has currently 65 registered `Field` Fuzzers:
44
- `AbugidasInStringFields` - iterate through each field and send values containing abugidas chars
55
- `DecimalFieldsLeftBoundaryFuzzer` - iterate through each Number field (either float or double) and send requests with outside the range values on the left side in the targeted field
66
- `DecimalFieldsRightBoundaryFuzzer` - iterate through each Number field (either float or double) and send requests with outside the range values on the right side in the targeted field
@@ -12,6 +12,7 @@ CATS has currently 60 registered `Field` Fuzzers:
1212
- `ExtremeNegativeValueIntegerFieldsFuzzer` - iterate through each Integer field and send requests with the lowest value possible in the targeted field
1313
- `ExtremePositiveValueDecimalFieldsFuzzer` - iterate through each Number field and send requests with the highest value possible in the targeted field
1414
- `ExtremePositiveValueInIntegerFieldsFuzzer` - iterate through each Integer field and send requests with the highest value possible in the targeted field
15+
- `InsertWhitespacesInFieldNamesField` - iterates through each request field name and insert random whitespaces
1516
- `IntegerFieldsLeftBoundaryFuzzer` - iterate through each Integer field and send requests with outside the range values on the left side in the targeted field
1617
- `IntegerFieldsRightBoundaryFuzzer` - iterate through each Integer field and send requests with outside the range values on the right side in the targeted field
1718
- `InvalidValuesInEnumsFieldsFuzzer` - iterate through each ENUM field and send invalid values
@@ -21,10 +22,12 @@ CATS has currently 60 registered `Field` Fuzzers:
2122
- `LeadingControlCharsInFieldsTrimValidateFuzzer` - iterate through each field and send requests with Unicode control chars prefixing the current value in the targeted field
2223
- `LeadingSingleCodePointEmojisInFieldsTrimValidateFuzzer` - iterate through each field and send values prefixed with single code points emojis
2324
- `LeadingMultiCodePointEmojisInFieldsTrimValidateFuzzer` - iterate through each field and send values prefixed with multi code points emojis
24-
- `MaxLengthExactValuesInStringFieldsFuzzer` - iterate through each **String** fields that have maxLength declared and send requests with values matching the maxLength size/value in the targeted field
25-
- `MaximumExactValuesInNumericFieldsFuzzer` - iterate through each **Number and Integer** fields that have maximum declared and send requests with values matching the maximum size/value in the targeted field
26-
- `MinLengthExactValuesInStringFieldsFuzzer` - iterate through each **String** fields that have minLength declared and send requests with values matching the minLength size/value in the targeted field
27-
- `MinimumExactValuesInNumericFieldsFuzzer` - iterate through each **Number and Integer** fields that have minimum declared and send requests with values matching the minimum size/value in the targeted field
25+
- `LowercaseExpandingBytesInStringFields` - iterate to string fields and send values that expand the byte representation when lowercased
26+
- `LowercaseExpandingLengthInStringFields` - iterate to string fields and send values that expand their length when lowercased
27+
- `MaxLengthExactValuesInStringFieldsFuzzer` - iterate through each string fields that have maxLength declared and send requests with values matching the maxLength size/value in the targeted field
28+
- `MaximumExactValuesInNumericFieldsFuzzer` - iterate through each integer fields that have maximum declared and send requests with values matching the maximum size/value in the targeted field
29+
- `MinLengthExactValuesInStringFieldsFuzzer` - iterate through each string fields that have minLength declared and send requests with values matching the minLength size/value in the targeted field
30+
- `MinimumExactValuesInNumericFieldsFuzzer` - iterate through each number fields that have minimum declared and send requests with values matching the minimum size/value in the targeted field
2831
- `NewFieldsFuzzer` - send a 'happy' flow request and add a new field inside the request called 'catsFuzzyField'
2932
- `NullValuesInFieldsFuzzer` - iterate through each field and send requests with null values in the targeted field
3033
- `OnlyControlCharsInFieldsTrimValidateFuzzer` - iterate through each field and send values with control chars only
@@ -50,6 +53,8 @@ CATS has currently 60 registered `Field` Fuzzers:
5053
- `TrailingControlCharsInFieldsTrimValidateFuzzer` - iterate through each field and send requests with trailing with Unicode control chars in the targeted field
5154
- `TrailingSingleCodePointEmojisInFieldsTrimValidateFuzzer` - iterate through each field and send values trailed with single code point emojis
5255
- `TrailingMultiCodePointEmojisInFieldsTrimValidateFuzzer` - iterate through each field and send values trailed with multi code point emojis
56+
- `UppercaseExpandingBytesInStringFields` - iterate to string fields and send values that expand the byte representation when uppercased
57+
- `UppercaseExpandingLengthInStringFields` - iterate to string fields and send values that expand their length when uppercased
5358
- `UserDictionaryFieldsFuzzer` - iterates through each request fields and sends values from the user supplied dictionary
5459
- `VeryLargeStringsFuzzer` - iterate through each String field and send requests with very large values (40000 characters) in the targeted field
5560
- `VeryLargeDecimalsInNumericFieldsFuzzer` - iterate through each numeric field and send requests with very large numbers (40000 characters) in the targeted field

‎docs/fuzzers/field-fuzzers/insert-whitespaces-in-field-names.md‎

Whitespace-only changes.

‎docs/fuzzers/field-fuzzers/lowercase-expanding-bytes.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
hide_table_of_contents: true
3+
---
4+
5+
# Lowercase Expanding Bytes in String Fields
6+
7+
| Item | Description |
8+
|:--------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
9+
| **Full Fuzzer Name** | LowercaseExpandingBytesInStringFieldsFuzzer |
10+
| **Log Key** | **LEBISF** |
11+
| **Description** | This fuzzer send characters that expand their byte representation when lower cased. The expectation is that APIs will either respond with `2xx` or `4xx`. |
12+
| **Enabled by default?** | Yes |
13+
| **Target field types** | All array fields |
14+
| **Expected result when fuzzed field is required** | `2XX` or `4XX` |
15+
| **Expected result when fuzzed field is optional** | `2XX` or `4XX` |
16+
| **Expected result when fuzzed value is not matching field pattern** | `2XX` or `4XX` |
17+
| **Fuzzing logic** | Iteratively **replaces** string fields with characters such as `Ⱥ` or `Ⱦ` |
18+
| **Conditions when this fuzzer will be skipped** | When field is not a string |
19+
| **HTTP methods that will be skipped** | None |
20+
| **Reporting** | Reports `error` if: *1.* response code is `5xx`; <br/><br/> Reports `warn` if: *1.* response code is expected and documented, but not matches response schema; *2.* response code is expected, but not documented; *3.* response code is `501`. <br/><br/> Reports `success` if: *1.* response code is expected, documented and matches response schema. |

‎docs/fuzzers/field-fuzzers/lowercase-expanding-length.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
hide_table_of_contents: true
3+
---
4+
5+
# Lowercase Expanding Length in String Fields
6+
7+
| Item | Description |
8+
|:--------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
9+
| **Full Fuzzer Name** | LowercaseExpandingLengthInStringFieldsFuzzer |
10+
| **Log Key** | **LELISF** |
11+
| **Description** | This fuzzer send characters that expand their length when lower cased. The expectation is that APIs will either respond with `2xx` or `4xx`. |
12+
| **Enabled by default?** | Yes |
13+
| **Target field types** | All array fields |
14+
| **Expected result when fuzzed field is required** | `2XX` or `4XX` |
15+
| **Expected result when fuzzed field is optional** | `2XX` or `4XX` |
16+
| **Expected result when fuzzed value is not matching field pattern** | `2XX` or `4XX` |
17+
| **Fuzzing logic** | Iteratively **replaces** string fields with characters such as `İ` |
18+
| **Conditions when this fuzzer will be skipped** | When field is not a string |
19+
| **HTTP methods that will be skipped** | None |
20+
| **Reporting** | Reports `error` if: *1.* response code is `5xx`; <br/><br/> Reports `warn` if: *1.* response code is expected and documented, but not matches response schema; *2.* response code is expected, but not documented; *3.* response code is `501`. <br/><br/> Reports `success` if: *1.* response code is expected, documented and matches response schema. |

0 commit comments

Comments
 (0)