TNO-S3 / WuppieFuzz

A coverage-guided REST API fuzzer developed on top of LibAFL
Apache License 2.0
91 stars 4 forks source link

Display request and response data for `verify-auth` #31

Open ringogroenewegen opened 2 weeks ago

ringogroenewegen commented 2 weeks ago

Is your feature request related to a problem? Please describe. Getting authentication setup for a new target is generally quite challenging. Having as much data as possible available will help in getting the authentication setup as quickly as possible. It is sometimes challenging to determine why authentication is failing because there are so many types of authentication.

Describe the solution you'd like When running wuppiefuzz verify-auth the output should show the request sent to an endpoint as well as the response. This should be displayed in case the authentication fails.

Possibly it could also be helpful to see the request/response data even if authentication succeeds to allow the user to determine by inspection if it is a true success. For some poorly designed APIs it is possible that a success code is returned even if authentication fails, i.e. they don't return a 401 code. In those cases it would be helpful to see the request/response data.