Method _fuzz_endpoints

modules/apisec/fuzzer.py:166–197

Fuzz all endpoints. Yields: FuzzResult for each test

(self, api: ParsedAPI)

            target=target,
            success=True,
            findings=all_findings,
            data={
                "api_title": api.title,
                "requests_sent": request_count,
                "findings_count": len(all_findings),
            },
        )

    async def _fuzz_endpoints(
        self, api: ParsedAPI, base_url: str
    ) -> AsyncIterator[FuzzResult]:
        """Fuzz all endpoints.

        Args:
            api: Parsed API specification
            base_url: Validated base URL to send requests to

        Yields:
            FuzzResult for each test
        """
        headers = self._get_headers()

        async with httpx.AsyncClient(timeout=self.timeout) as client:
            for endpoint in api.endpoints:
                # Get baseline response
                baseline = await self._get_baseline(client, base_url, endpoint, headers)

                # Fuzz each parameter
                for param in endpoint.parameters:
                    payloads = self._get_payloads_for_type(param.param_type)

                    for payload in payloads:
                        result = await self._fuzz_parameter(
                            client, base_url, endpoint, param, payload, headers, baseline
                        )