A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing.
There's a nuanced difference between fuzz_lightyear.exclude.operations and fuzz_lightyear.exclude.non_vulnerable_operations: the former skips over the endpoint completely, and the latter tests the endpoint, but ignores the IDORPlugin result.
This nuance makes an important difference when generating sequences of length n>1, or when the Swagger schema is incorrect. If the endpoint is completely excluded, the test run will be faster, since there are less total sequences to create. Furthermore, invalid Swagger schemas will be ignored as well.
For the times we want this trade-off, this PR introduces the new flag --ignore-non-vulnerable, which will treat excluded non_vulnerable_operations as completely excluded operations.
Summary
There's a nuanced difference between
fuzz_lightyear.exclude.operations
andfuzz_lightyear.exclude.non_vulnerable_operations
: the former skips over the endpoint completely, and the latter tests the endpoint, but ignores theIDORPlugin
result.This nuance makes an important difference when generating sequences of length n>1, or when the Swagger schema is incorrect. If the endpoint is completely excluded, the test run will be faster, since there are less total sequences to create. Furthermore, invalid Swagger schemas will be ignored as well.
For the times we want this trade-off, this PR introduces the new flag
--ignore-non-vulnerable
, which will treat excludednon_vulnerable_operations
as completely excluded operations.