foREST: A Tree-based Approach for Fuzzing RESTful APIs

by   Jiaxian Lin, et al.

Representational state transfer (REST) is a widely employed architecture by web applications and cloud. Users can invoke such services according to the specification of their application interfaces, namely RESTful APIs. Existing approaches for fuzzing RESTful APIs are generally based on classic API-dependency graphs. However, such dependencies are inefficient for REST services due to the explosion of dependencies among APIs. In this paper, we propose a novel tree-based approach that can better capture the essential dependencies and largely improve the efficiency of RESTful API fuzzing. In particular, the hierarchical information of the endpoints across multiple APIs enables us to construct an API tree, and the relationships of tree nodes can indicate the priority of resource dependencies, e.g., it's more likely that a node depends on its parent node rather than its offspring or siblings. In the evaluation part, we first confirm that such a tree-based approach is more efficient than traditional graph-based approaches. We then apply our tool to fuzz two real-world RESTful services and compare the performance with two state-of-the-art tools, EvoMaster and RESTler. Our results show that foREST can improve the code coverage in all experiments, ranging from 11.5% to 82.5%. Besides, our tool finds 11 new bugs previously unknown.


page 1

page 2

page 3

page 4


REST-ler: Automatic Intelligent REST API Fuzzing

Cloud services have recently exploded with the advent of powerful cloud-...

Deriving Semantics-Aware Fuzzers from Web API Schemas

Fuzzing – whether generating or mutating inputs – has found many bugs an...

Pythia: Grammar-Based Fuzzing of REST APIs with Coverage-guided Feedback and Learning-based Mutations

This paper introduces Pythia, the first fuzzer that augments grammar-bas...

Adaptive REST API Testing with Reinforcement Learning

Modern web services increasingly rely on REST APIs. Effectively testing ...

MINER: A Hybrid Data-Driven Approach for REST API Fuzzing

In recent years, REST API fuzzing has emerged to explore errors on a clo...

RULF: Rust Library Fuzzing via API Dependency Graph Traversal

Robustness is a key concern for Rust library development because Rust pr...

Specification and Automated Analysis of Inter-Parameter Dependencies in Web APIs

Web services often impose inter-parameter dependencies that restrict the...

Please sign up or login with your details

Forgot password? Click here to reset