search

KissPeter / APIFuzzer

Fuzz test your application using your OpenAPI or Swagger API definition without coding
GNU General Public License v3.0
415 stars 65 forks source link

How to use HTTPS? #73

Open henning410 opened 2 months ago

henning410 commented 2 months ago

As you mentioned here, HTTPS is supported. I cannot find any info about how actually I can do this. I tried it with the following command:

docker run --network host -it --volume /home/user/Desktop/KissPeter-APIFuzzer/results:/results/ kisspeter/apifuzzer --src_url https://172.19.0.1:3000/api-json --url https://172.19.0.1:3000 --test_report /results/junit.xml --report /results/report/

I get the error: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:992)

Without HTTPS, the APIFuzzer works.

KissPeter commented 1 month ago

Hi,

APIFuzzer indeed capable to test https endpoints. In your case the issue is with the invalid certificate. Either disable SSL cert at the application under test or the project is open to contribution. It seems like a simple extension based on https://stackoverflow.com/a/13072667 here: https://github.com/KissPeter/APIFuzzer/blob/master/apifuzzer/fuzzer_target/fuzz_request_sender.py#L127

Thanks