search

microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.59k stars 297 forks source link

set the mutated value #329

Open higher75 opened 3 years ago

higher75 commented 3 years ago

Hi ,How can I set a mutated dictionary for the specified field, when I run this project？

marina-p commented 3 years ago

Hello @higher75,

If I understand your question correctly, say you have a specific field in the body named "location". You can tell RESTler to replace all occurences of that field with a list of values using restler_custom_payload in the dictionary, either via just a string value or the full json pointer. See Fuzzing Dictionary documentation for further details.

Is this what you were looking for?

Thanks,

Marina

higher75 commented 3 years ago

Thanks you I know that I can set some values in the restler_fuzzable_string field in dict.json, such as: "restler_fuzzable_string": [ "//////////////", "################", "*****", ")))))))))))))", "___" ], But according to the data packet sent out, I found that the field values are some example values, such as "fuzzstring". If I have many apis, and then I want to use a unified api payload, how should I set it up?

marina-p commented 3 years ago

@higher75

1) Can you please share the command line you are using? You are probably trying the 'Test' mode of RESTler, which only tests one value and stops if it succeeds. Still, I believe it should be testing your values first before 'fuzzstring', which is the default value (we will investigate this, seeing your command line would help). You can try the '--test_all_combinations' switch in Test mode, or try Fuzz mode to get all of your values to be tried.

2) Regarding your request - do you want all the parameter values to be fuzzed with the above values, regardless of data type? Right now it needs to be set per type, so 'restler_fuzzable_string', 'restler_fuzzable_int', 'restler_fuzzable_bool' etc. you would have to copy the above list into all those properties, RESTler doesn't have a global list you can specify.

higher75 commented 3 years ago

1.This is the cmd $ /Restler fuzz --grammar_file Compile/grammar.py --dictionary_file Compile/dict.json --settings Compile/engine_settings.json --time_budget 0.05 --target_ip 0.0.0.0 --target_port 8080

  1. I probably know what you mean, similar to restler_fuzzable_string, restler_fuzzable_int is for all apis and has different type values, and restler_custom_payload can be fuzzed for the specified api, is that what it means? In other words, I can specify dict.json every time I run, right?