Skip to content

Lightfuzz - Try POST as Get feature#2914

Merged
liquidsec merged 6 commits intodevfrom
lightfuzz-try-post-as-get
Feb 25, 2026
Merged

Lightfuzz - Try POST as Get feature#2914
liquidsec merged 6 commits intodevfrom
lightfuzz-try-post-as-get

Conversation

@liquidsec
Copy link
Collaborator

@liquidsec liquidsec commented Feb 22, 2026

This PR adds an optional feature to lightfuzz (off by default, but on on medium and above presets) that automatically tries every POST parameter as a GET parameter. Interesting behavior can occur sometimes when this is done, which can sometimes expose hidden vulnerabilities. Especially interesting when POST's are disabled, allowing the found POSTPARAM events to still be used.

Also adds the other direction, try GET as POST. Same concept in reverse, added to heavy and up presets.

When enabled, POSTPARAM events are additionally fuzzed as GETPARAMs.
Findings from converted parameters are annotated with
"(converted from POSTPARAM)" in the description. Enabled by default
in medium and heavy presets.
@liquidsec liquidsec marked this pull request as draft February 22, 2026 00:53
@github-actions
Copy link
Contributor

github-actions bot commented Feb 22, 2026

📊 Performance Benchmark Report

Comparing dev (baseline) vs lightfuzz-try-post-as-get (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name 📏 Base 📏 Current 📈 Change 🎯 Status
Bloom Filter Dns Mutation Tracking Performance 4.25ms 4.24ms -0.3%
Bloom Filter Large Scale Dns Brute Force 17.82ms 18.82ms +5.6%
Large Closest Match Lookup 358.68ms 353.23ms -1.5%
Realistic Closest Match Workload 193.96ms 195.35ms +0.7%
Event Validation Full Scan Startup Small Batch 489.97ms 487.43ms -0.5%
Event Validation Full Scan Startup Large Batch 826.12ms 837.85ms +1.4%
Make Event Autodetection Small 31.25ms 31.09ms -0.5%
Make Event Autodetection Large 314.12ms 315.06ms +0.3%
Make Event Explicit Types 13.93ms 14.13ms +1.4%
Excavate Single Thread Small 4.097s 4.080s -0.4%
Excavate Single Thread Large 9.877s 9.994s +1.2%
Excavate Parallel Tasks Small 4.309s 4.266s -1.0%
Excavate Parallel Tasks Large 7.397s 7.411s +0.2%
Is Ip Performance 3.21ms 3.21ms +0.2%
Make Ip Type Performance 11.57ms 11.46ms -0.9%
Mixed Ip Operations 4.51ms 4.51ms +0.1%
Typical Queue Shuffle 62.55µs 60.52µs -3.2%
Priority Queue Shuffle 700.10µs 700.35µs +0.0%

🎯 Performance Summary

No significant performance changes detected (all changes <10%)


🐍 Python Version 3.11.14

@codecov
Copy link

codecov bot commented Feb 22, 2026

Codecov Report

❌ Patch coverage is 98.96907% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 92%. Comparing base (3148e7f) to head (65df620).

Files with missing lines Patch % Lines
.../test_step_2/module_tests/test_module_lightfuzz.py 99% 1 Missing ⚠️
Additional details and impacted files
@@          Coverage Diff           @@
##             dev   #2914    +/-   ##
======================================
+ Coverage     92%     92%    +1%     
======================================
  Files        416     416            
  Lines      34467   34559    +92     
======================================
+ Hits       31424   31532   +108     
+ Misses      3043    3027    -16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Symmetrical to try_post_as_get: additionally fuzzes GETPARAMs as
POSTPARAMs. Enabled in heavy/superheavy presets.
@liquidsec liquidsec marked this pull request as ready for review February 22, 2026 18:13
@liquidsec liquidsec merged commit a62462b into dev Feb 25, 2026
10 of 23 checks passed
@liquidsec liquidsec mentioned this pull request Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants