I'm trying to do a PoC with Atheris, and I started to fuzz a endpoint in my api:


Am I testing something useful with this? Or should I only use fuzz inputs in HTTP body?

  • What does the <fuzz> part of the URL do ? Hitting random URLs is one way of fuzzing a system
    – Rsf
    Jan 27, 2021 at 12:38
  • In this case, it can retrieve an item from this entity. Goal is to see if the api handles unknown entities as 404, not 500 Jan 27, 2021 at 12:44
  • If the goal is to just verify 404 on unknown, that doesn't sound like a good candidate for fuzzing. Just using a random path param once seems sufficient, no need to do it over and over . . .
    – ernie
    Jan 27, 2021 at 17:32
  • 1
    Unless those paths include special characters, long strings etc. a fuzzer can do that for you given enough run time
    – Rsf
    Jan 28, 2021 at 8:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.