WebFuzzing / EvoMaster

The first open-source AI-driven tool for automatically generating system-level test cases (also known as fuzzing) for web/enterprise applications. Currently targeting whitebox and blackbox testing of Web APIs, like REST, GraphQL and RPC (e.g., gRPC and Thrift).
GNU Lesser General Public License v3.0
500 stars 83 forks source link

Details how to use evomaster + info on found faults #765

Open bungdanar opened 1 year ago

bungdanar commented 1 year ago

Hi, I'm currently trying evomaster to do blackbox testing on a RESTful API written in the NodeJs and Python programming languages. I'm using evomaster via windows installer.

I've tried running evomaster for 15 minutes and managed to generate tests. After the tests have been generated, should I run the tests? And how do I install dependencies to be able to run the tests?

arcuri82 commented 1 year ago

hi. by default, tests are generated in Java for JUnit. If you using NodeJS, can try the experimental option --outputFormat=JS_JEST

bungdanar commented 1 year ago

Hi, thank you so much for the answer. I was finally able to run the JUnit tests after installing the required dependencies although it was quite difficult as I don't have much experience in the Java ecosystem.

I actually will use evomaster for my thesis paper. How do we know how many bugs the evomaster has found? For example, if there are 2 tests in the EvoMaster_faults_Test.java file, does that mean that evomaster has found 2 bugs?

arcuri82 commented 1 year ago

hi. on the console, you get the info Potential faults: .... But, indeed, we should provide better information in the generated EvoMaster_faults_Test files

arcuri82 commented 1 year ago

you can also use --writeStatistics=true, and check the potentialFaults column there in the generated CSV file

bungdanar commented 1 year ago

There is no information about Potential Faults in the console output. Maybe I missed a certain option parameter.

em-consolo-output

But the information about Potential Faults exists in the statistics.csv file

em-statistic-output

Anyway, thank you very much for the response.

arcuri82 commented 1 year ago

it is a bug, as it looks like we print it only for White-Box testing, but not for Black-box

wanglewang commented 11 months ago

--writeStatistics=true

if a api need auth token,how add token to testcases

alegonzalezz commented 11 months ago

@wanglewang I have the same problem. Can did You fix it?