search

microsoft / restler-fuzzer

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
MIT License
2.52k stars 283 forks source link

improve guidance in coverage-failures-to-investigate.txt #814

Open marina-p opened 9 months ago

marina-p commented 9 months ago

Description

In some cases, there are no responses for some or all of the requests logged in this file. The guidance paragraph should point the user to the network logs, or provide more information on why there was no response for those requests.

marina-p commented 9 months ago

For example:

When there isn't any response in the coverage file, it means RESTler could not connect to the service or there is a timeout

Gby56 commented 9 months ago

Hi Marina ! Thanks so much for RESTler, I started using it (macOS but inside the docker container) I would also add a reminder about --use_ssl because I used it directly on a staging/test environment and couldn't understand why I was not getting any coverage 😅

Another idea I had, but much bigger scope, was an interactive mode, because it's frustrating to see the coverage failures and just play with the config JSON for now, when I wished I could give some pointers for each specific path RESTler tries to explore. Maybe my choices could be saved as "guidance" for later use ?