1

I'm trying to do a PoC with Atheris, and I started to fuzz a endpoint in my api:

api/v2/pokemon/<fuzz>

Am I testing something useful with this? Or should I only use fuzz inputs in HTTP body?

4
  • What does the <fuzz> part of the URL do ? Hitting random URLs is one way of fuzzing a system – Rsf Jan 27 at 12:38
  • In this case, it can retrieve an item from this entity. Goal is to see if the api handles unknown entities as 404, not 500 – Ramon Medeiros Jan 27 at 12:44
  • If the goal is to just verify 404 on unknown, that doesn't sound like a good candidate for fuzzing. Just using a random path param once seems sufficient, no need to do it over and over . . . – ernie Jan 27 at 17:32
  • 1
    Unless those paths include special characters, long strings etc. a fuzzer can do that for you given enough run time – Rsf Jan 28 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.