Automating API Penetration Testing using fuzzapi
summary
A working API fuzzer called Fuzzapi is released as an OWASP project: a Ruby gem plus a Rails UI that uses Sidekiq/Redis, MySQL and optional Docker images so scans run via two Docker commands or a 30–40 minute local install. It fuzzes headers and parameters, flags XXE checks, IDORs, rate‑limiting and header disclosures, reports in ~120–240s per scan, and the team claims automation covers roughly 25–40% of routine API tests and has already found multiple real XXE instances.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:51Automate REST API pen testing
- 8:29Benefits of automated security
- 13:16Live demo: Fuzzapi
- 20:17How Fuzzapi works
- 27:47Fuzzapi architecture
- 34:23Fuzzapi in CI/CD
- 37:12Adopting Fuzzapi
- 40:41Access and contribute to Fuzzapi
- 41:43Q&A
related talks
45mFuzz Testing Web APIs: Overview of Existing Tools
23mFuzzing API to identify API1: broken object level authorization control
49mData sources for fuzzing web application APIs
26mOffensive API Penetration Testing
15mJumpstart Security & Penetration Testing APIs
08mAutomated Security Testing for JS Apps
53mHacking And Defending APIs: Red And Blue Make Purple
53mFuzz Testing for Fun and Profit