search

matusf / openapi-fuzzer

Black-box fuzzer that fuzzes APIs based on OpenAPI specification. Find bugs for free!
GNU Affero General Public License v3.0
526 stars 22 forks source link

Feature Request: Store all Request #18

Open tandarim opened 2 years ago

tandarim commented 2 years ago

In some cases i`m interested in 404 or 200 responses. A flag would be great to tell the fuzzer to store all requests or (like the -i flag) to specify the response code which should be stored.

Is this an edge case, or could this be beneficial to bigger a audience?

matusf commented 2 years ago

Hi, what is your use case for this feature? If we store also the valid responses, the fuzzer will create a lot of files really quickly, possibly filling your hard drive.

lmeinen commented 2 years ago

Hi! Maybe I can add on to this: In my case, I'm seeing a small fraction of requests not returning error codes. Considering the strings look very random, the odds of this happening should be slim to none. Therefore, it would be interesting to see for which strings the 200 status codes are returned. Perhaps it'd be possible to have a flag where one could explicitly list the status codes for which requests should be stored (in combination with the particular endpoints)?