search

Yelp / fuzz-lightyear

A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing.
Other
205 stars 25 forks source link

Supporting JSON body parameters and headers in cURL logs #52

Closed domanchi closed 4 years ago

domanchi commented 4 years ago

Summary

The cURL logs from the individual test cases are designed to allow for easy reproduction. As in:

Want to try the request yourself, without using fuzz-lightyear? Just try these cURL sequences.

However, in its current state, the output doesn't include custom headers (e.g. victim session token), nor does it support JSON body parameters.

This PR fixes this.

Example

$ fuzz-lightyear http://localhost:5000/schema -f test_data -t complex
================================== fuzzing session starts ==================================
Hypothesis Seed: 325673964611793753086228761148234643037

complex E
====================================== Test Failures ======================================
__________________________ complex.post_nested_model [IDORPlugin] __________________________
Request Sequence:
[
  "curl -X POST http://localhost:5000/complex/nested --data '{\"info\": {\"session\": \"\\u001d\\u001d\\ud9ce\\udd4c-)\\ud966\\ude24\"}, \"name\": \"-\\u0011\\u000e!\\udb27\\udd4e\\ud966\\udfe3\\ud8d5\\udf39\\u0011\\\"\"}' -H 'Content-Type: application/json' -H 'Cookie: session=victim_session'"
]

================================= 1 failed in 0.04 seconds =================================