Fuzzing API Payload Only

[brendan-c-riley]

Description

I am trying to use the restler-fuzzer to fuzz an API with a single endpoint and have the fuzzer obey the grammar and fuzz only the payload body. I am curious whether or not this is possible. When I compile the fuzzer with the grammar it uses default values of 1 and 1.23 and attempts to query the API with those values. If I manually edit the grammar.py or grammar.json to provide example payloads to the fuzzer it seems that it will only use the examples I provide and not generate any values of its own. I have tried setting examples through the dict.json file manually and an examples.json as well. Ideally, I could configure the fuzzer to be able to use my examples at first, but then fuzz the payload body with it's own generated payload values. I have attached the contents of my settings.json file for context. Any help would be appreciated.

restler_user_settings.json

[marina-p]

Hi @brendan-c-riley,

Yes, it is possible to fuzz the payload body only using the payload body checker. The checkers are independent, so you can turn off all other checkers in the settings.json.

By default, the value strategy is to use values from examples (examples.json) and responses (if your responses are also json, heuristics are used to initialize future inputs from values in past responses). If neither of these are found, fuzzing falls back on default values. We have found the above strategy to be the most effective in the studies done for the paper. If you'd like to have random values generated similarly to the invalid value checker:

1. Enable the following in the payload body checker engine settings:

"payloadbody"{
      "use_wordbook_for_fuzzable": true
}

2. Use dynamic value generators to plug in your own functions to generate data for the desired properties (you can use the default one provided by RESTler as a starting point - restler/checkers/invalid_value_checker_value_gen.py).

However, please note that we do not test the payload body checker in the non-default configuration, and it's been a while since it was exercised - please let me know if you see any issues.

Thanks,

Marina

[brendan-c-riley]

Thank you for the detailed explanation! I was curious if there is any behavior in RESTler that can generate payload body values in a non random way? I was hoping I could use this as a tool to come up with unique values that fit within my json grammar. I know this is a long shot and I probably have to make modifications myself to get this behavior. Is it possible to force the RESTler to operate within the bounds of the grammar? Even when I only have the payload_body checker enabled it will still only generate properly formatted requests around 2.5% of the time (~300 / ~12000).

Thanks for your time in advance,
Brendan