matusf / openapi-fuzzer

Black-box fuzzer that fuzzes APIs based on OpenAPI specification. Find bugs for free!
GNU Affero General Public License v3.0
526 stars 22 forks source link

Question about disabling some params' mutations #26

Closed lipeng28 closed 1 year ago

lipeng28 commented 1 year ago

Hi There Is that possible for openapi fuzzer to disable the mutation of some specific params? Because these params are set through headers. Thanks Peng

matusf commented 1 year ago

Hi, I'm not sure I follow you. Could you please explain in more detail? Or give an example? If you specify extra headers via the -H flag, the field will not take any other value than the supplied header (i.e. it will not be mutated).

lipeng28 commented 1 year ago

Yes, what I meant is this. If the value of a variable is provided through -H flag, fuzzers won't mutate this variable any longer.

Hi, I'm not sure I follow you. Could you please explain in more detail? Or give an example? If you specify extra headers via the -H flag, the field will not take any other value than the supplied header (i.e. it will not be mutated).

lipeng28 commented 1 year ago

Hi @matusf I tried a example, and found that a variable specified through -H option still got mutated, do you have any ideas about it? The detailed information is shown below:

"headers": [
  [
    "tenant-key",
    "xxx"
  ],
  [
    "open-id",
    "xxx"
  ]
],
"method": "GET",
"path": "/open-apis/merge/v1/account_token",
"path_params": [],
"query_params": [
  [
    "tenant-key",
    "󳅯𰫘󿸋󛙭򊴏򕑸񄋣󀽡򛕰쏿󢡾򀔌󂈧񿇘񠀄򤛎񦴵𘯴󢙞𘉞𧧕񭾛񘕍񅶘󝷫􃷭󓚿󣧡󖤕񬒑򦯒􂌯򔏋񸾋󞶗􍹱󲚢򉙤򌯗􈒵󄽝􏶵򐕨󈟲󸻚񈌫𜮃𣾆򘚢󂺥񃭒󰏽򯛥폒򢙥񈢇񩟖𵒏񌭙򎗟󔆸򊷅򏿌񳱢򖉔򬇾剹񳂝𘜑򂅕򤀹󕉋𱧘𭣃򍒞񅃪󨸀𼽼򞧌򑅸𵮫񺢜󐟪𩩕򥔴󫭠񹤣𻥔򹙒󩹊񊠖򭠈𺒯𜏈󧍵󌈅񑄢쯻򛏓򿼝򲌙𵅞񐤽򏱴򂠳򡉋𢚧󾋪񪮠򛪫󞧠𦨉񷡨񵷿󋍢𞻭󑧈𯓠쉱󚼆󝃧􀹘󊩾𻆲󀦲񗳝򾤧򔴌􇉒򩹞򐮮󞤦򠄕𕭢񴌜񺅬󒓡󼬤𙟤𰈌󜨙𛳈􌠻񤻬񕴽񑻨𔳢𹩱󫏿󌰓򿀍򊑞񎼨򿃈󕨭򅓲񃟖󴮩󶇖񹕝𗮧󇻮𮳇񍀎俤𖂙򝲅񈗏񃤢󀈣򲯵񨄅򧒜򃁏󋊁񝠃񰩆񉈘򞣐𔚕򅶞񝻌򺍮𪳧󍰍򎈝𝞑򰶙󈖑󀶨𿆓򧫺򈊁󹐕򁲃򬅑󴼲簜󌩵򟏋򁪽񇩄󂃬㌍姉􊫏󬂲󐢨񶺅𒐱󥕟򉧙ꙍ𤤠𤮿󡿖𺠕󂘨񈆼񌓵⥺𳕻𒂄񮖶𧮸񱏅򜥏򘔣󃂟򃵝𷄞񀗤񠻃𪷯󚗘󃏖򄯭񵺶>𸎊𧤂򴇬򐎖󺓙󒦅𤆣񔅖򂁋򻓦𱂧𥐠򰑐򓓦򄒫󮹞򧨊򚄴󢙆񹘕󷰫򼵦󓅯󉻚󥱳󽇝򤹹򐋥񋪋󝺨򁦹ކ𨯻񴮲𛵬󘥕񰅵񖛩ꮨ󩽿񑥍𖧯񾟵緓񽙨󵠯񑖚񉃿񴦵򃾫򩉹򟋯󮆠񠸑򘌮𶢡񕺨􌜀񉷞􁥝󙶰񕄡򳿽򼂷򳘅𾫅𨋿􍅈񈾚󫯚𧉹󗶽󜣥񎭂򁉹򕍒󃰥񘆬󣛁򫇶񟯑胓󴑍󍙌𩩢򭼐񾫊⩂𒣇򠜙󇐗򡊣񮜅𸼪𼥴􋒓񟮕񐲴𮔆󘾘𙫏񤩅򪟨񰺣𞌤򅹐򚷺򏸴򅥊򏓆񷝇󱽊𬸻򉎌𙆉󑀜𤱸򚬚𹌋󪗪늌𩇞>𼀻𨝾񙂽󪭏񶷉񆱂󙴭񋂍󻚣􉞃􄞥󡭿𺙱򞋴柧򲎨𞝿񊲇񥑄񌎶򀬈񵌘🚺򕋜򺃚񘟟𨎻𚐡󖭗򗺈񺌅𵬳󥳮񜢫󡄝񯩤󞶫🻉򂺞񦝝忤󽯯󉍦򯱎󙺉򢠂񭃤󵔛򔕓򖄡𬆽򎴩ꍆ􃂉򌻂򠋢𦳰񲬞񿁿󫼚𺙾𐴻󨬵񞸣󣠹񯎁󓳞񲯖𓆴򙍿񋇖󁝘򂪿𶏎񮆥񜂷𚩥󫢀轝򵩧󬰊죽󋙔񓳚򆫏􉦥𑦗𞭔럲񈔰𵵼򯱦􉝺򷢅򔘺􎨷𤈗򚫅羕󡂭򹡎󇾵𐔀🤳𷻅󧢡򜣩񙽜򾔰򱔆󎷢򰩦񜯝򓏠𔩅񷡘𘊄󘺞񖟃񗞘ꇗ>𼨽񀛳񣮎򅓄󬠥🿚𠻃𱬳𹒙񔼯󫉹󐍗򷶾򿇯􁋢򻣿򕾂򛝽񵚳󷊦𛦓񛖧򧳅򊁱򍡸󖝈𮎓𰩣󌷽󀂯󻚍񦬑􉵟󩼖򖽥񮸄񿫆󲽟󁌻򒳣􋇊񁑺𑍌򡠬󔊼󔸵𩢸𖸐𫝞󛡛󠷼𥡦󤅿𚮘򶾩񇼎󢮕󒬞񅧙𿓘򫷆󴠍𮯭󿥮򴂃񠜧𾭖򣄏󳙽􉪆󰠅񑼘񅗍󾸧򼋀񖈽𘃂􆙼𓹎򅭴󇅅𜇟𒆑󐯍𺩔𷊋񣅌𨜫򓖖ᙄ򯿮񇝽𲽌򢹒񥑒󠋲򕡰񞲓󈱺񷎾񻒯󡷕􌥔𠹔𝥧󁟮瘫񫯱𨮲򪖴𾻭򾴾󣒨󊚀񨚓󞔱𿩧󅇓󔝈񩯇𨽙

򝤓𺯺鎶񎭟򝯔򏵻򊐆򤛎򼟫𪻤󦦍𝚟򼫮񜱺񤹸򣆟𙖖𙁟򣎺󹉇󶶃򔱔񌘖񛺇񑼺𒛸񺼎􆝉󀏐󫰑𧟞𦰣򏕶򘖆𥓣򗨝󣬔񛔏񪇧􋁸󥎬񺃜񱿐􏡿󥴨盄󵦡𞪎𺽤􍳱񘕃򶋱𕜜򟛉񪨕񢘿󘁇񒞨񎋘􁷢򵚽𫯣𰮆𻷈󒶵򸍾򸎟𪃾򧃠ࢨ􁈐󼐞򚐄򑩛󂕞󟩽𯕹🌩 񡺈񫳼󍬭񉁴𢊆򣝬񪣒𳊡⽭𫎉򣊻򵤬򫭽󻹤􌓔𻌅򹴑󇸦񒝦󙧻򞼺񃙄𭻥񗵮򖰍򑗘񼪤󌭛󰫳𾨢󷚅񷿈񳜡򜔛񿇂󣣥򬡛񂢷𯞄񄰓􈬗󌽾򊯌𡯛 󽀲򿠋򿂔񟬤󞂥𧍼𙾪𕾉𶱊𩤜󪧄𡬐󡁏򛄅ㄗ􈃢񧇫񕰤񈾾􍳓򽃑򋨄򇕝󙫼򇜱𬻳򫰆򻽪𸩍񖕄𑚟򔫍񽬄򾂋󐤵򯯴򭖵򻰤􃙎񾺶򬟖񟟄򸞤򣄛򱵉蘻󙐕󛈚󢼽񧺥񤮈򬂰򄸶񢩂􊿙񹣫򝡅򱧂򫺓𜋎🨋򗚴󎝑򁃴򼡩򞷱򨣋󜸈󓸨򈟩𴨐✣󇥦񻹤񶉢𛵙󪼃걝򪛍񖵉򺆦󁹫󽛟𽰯􎎒󅜾􄜃򥴢򎓼򨂄򂼛󍄠𔖌򨆘掊﹃󶌽𿏸򽽇𐊪𼙬𐞫󣌚򼀺𬱲񦸛񱗘򟁤坹𔌢򁡻󼈜󍎣𺧽񶽸𠛰쎝򣩳𔁯𥁴󒭔񘶥򆽫𻺍񛣵𓴂󧷂񳝌򄿧㋳񊸐򊫅󉕹񎿥󝺂򚅆􏚑񑅏𜥓񸶤򾓒񚮧󀪰𧨧󎋵𫙂򒯽򋳂􂂞󕂔򰘉ꋫ񌘴񬓗񓜉񠓃񒩟񍂖𽦰񋵎󱇭𲂮񯙭󯲗򥳱񾋜󄸣󹗊񯶑󖞿򚗴񅌂󎕭󧩋򥝷򱻻񟪁򥱶𚫱󌤙񻷒򵜟" ] ],

matusf commented 1 year ago

Thanks for the example. I see that the mutated parameter is a query string. The -H option is only for specifying headers. Currently there is no way to override / specify a query string parameter.

lipeng28 commented 1 year ago

What do you mean query string? i.e., -H "tenant-key: xxx"? From the description of developers, -H also provides the headers.