Data sources for fuzzing web application APIs
summary
Fuzzing web-application APIs to find vulnerabilities missed by SAST or manual review, demonstrating a concrete example. Focuses on the main challenge of collecting effective input data sources for API fuzzing and how those sources are used in the fuzzing process.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 5:02What is fuzzing
- 9:00Static vs dynamic scanning
- 14:17Fuzzing challenges and data sources
- 15:20OpenAPI and Swagger sources
- 17:29Postman collections for fuzzing
- 19:14Proxy traffic capture
- 22:06Web server logs as data
- 24:11Load testing data
- 25:35Automating fuzzing with Nuclei
- 28:23Nuclei template setup
- 31:54Advancing fuzzing process
- 36:44Summary
- 38:30Q&A
related talks
45mFuzz Testing Web APIs: Overview of Existing Tools
46mAutomating API Penetration Testing using fuzzapi
23mFuzzing API to identify API1: broken object level authorization control
30mFuzzing Testing: Practical Applications
53mFuzz Testing for Fun and Profit
47mFuzzing Your Code
31m“Fuzz or lose..."
01h 15mMake your programs more reliable with Fuzzing