Class APIFuzzer

modules/apisec/fuzzer.py:31–507

Automated API fuzzer for security testing.

class APIFuzzer:
    """Automated API fuzzer for security testing."""

    # SecLists paths for general fuzzing strings
    SECLISTS_FUZZ_PATHS = (
        "Fuzzing/big-list-of-naughty-strings.txt",
        "Fuzzing/FuzzingStrings-SkullSecurity.org.txt",
    )

    # Fuzz payloads by category
    PAYLOADS = {
        "string": [
            "",  # Empty
            " ",  # Space
            "null",
            "undefined",
            "None",
            "true",
            "false",
            "0",
            "-1",
            "999999999999",
            "A" * 1000,  # Long string
            "A" * 10000,  # Very long string
            "<script>alert(1)</script>",  # XSS
            "{{7*7}}",  # Template injection
            "${7*7}",  # Template injection
            "#{7*7}",  # Template injection
            "../../../etc/passwd",  # Path traversal
            "..\\..\\..\\windows\\system32\\config\\sam",
            "%00",  # Null byte
            "%0d%0a",  # CRLF
            "\r\n",  # CRLF
            "admin'--",  # SQL
            "1; DROP TABLE users",  # SQL
            '{"$gt": ""}',  # NoSQL
            "`id`",  # Command injection
            "| ls",  # Command injection
        ],
        "integer": [
            0,
            -1,
            1,
            2147483647,  # Max int32
            -2147483648,  # Min int32
            9999999999999999,  # Large number
            1.5,  # Float as int
            "1",  # String as int
            "abc",  # Invalid
            None,
        ],
        "boolean": [
            True,
            False,
            "true",
            "false",
            1,
            0,