Fuzz Testing Web APIs: Overview of Existing Tools
summary
Compares concrete tools—EvoMaster, CATS, Restler, Schemathesis—and reports experiments on real systems (a lab comparison over 36 APIs and deployments at Meituan and Volkswagen). Shows generated test suites typically shrink to tens or low hundreds of executable tests (a 30s run yields a minimized set), detects unexpected results like more errors in OpenAPI schemas than in code, and demonstrates both blackbox HTTP fuzzing and whitebox instrumentation that actually finds access‑policy and database‑dependent faults.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:50Web APIs and testing
- 3:19Manual API testing challenges
- 5:49Fuzz testing overview
- 6:57Top open-source API fuzzers
- 9:27API fuzzers and schemas
- 13:21Live demo: Pet Store API
- 20:13Generated test cases
- 20:35Authentication in fuzzing
- 23:51Security testing
- 26:02White-box testing with source code access
- 30:21Real-world success stories
- 35:40API fuzzing challenges
- 37:25Conclusion and recommendations
- 38:50Q&A
related talks
46mAutomating API Penetration Testing using fuzzapi
49mData sources for fuzzing web application APIs
23mFuzzing API to identify API1: broken object level authorization control
30mAPI Evolution With CRDs: Best Practices For Authoring & Fuzz Testing APIs
46mModern Testing Tools for Java Developers
53mFuzz Testing for Fun and Profit
08mAutomated Security Testing for JS Apps
19mFunctional Testing of GraphQL APIs: Simple Checks That Catch Real Bugs