fuzzapi/api-fuzzer

API Fuzzer which allows to fuzz request attributes using common pentesting techniques and lists vulnerabilities

Fuzzapi

Fuzzapi is rails application which uses API_Fuzzer and provide UI solution for gem.

New Scan

Scan Result

Scan Histoy

Setup

1. Install ruby in your machine either using rvm or rbenv

2. Clone the repository into your localmachine

3. cd /path/Fuzzapi/bin, move to Fuzzapi directory

4. bundle install to install the gem dependencies of the application

5. rake db:migrate to creates tables, migrations etc.

6. rails s to run the server and run export REDIS_URL=redis://127.0.0.1:6379/0 && bundle exec sidekiq to run sidekiq.

7. Open http://localhost:3000 in browser which should point to the application url

Fuzzapi comes with Docker to simplify installation processing. Following commands will setup application using Docker.

1. Clone the repository into your local machine

2. cd /path/Fuzzapi, move to Fuzzapi directory

3. Install Docker in your local machine

4. Run docker-compose build to build the image locally.

5. Run docker-compose up to run the server.

6. Open http://localhost:3000 in browser which should point to the application url

Fuzzapi uses API_Fuzzer gem.

Authors: www.twitter.com/abhijeth; www.twitter.com/lalithr95; www.twitter.com/srini0x00

api-fuzzer's Issues

Inventory notification

Fuzzapi and API-fuzzer have been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#API-fuzzer
https://inventory.rawsec.ml/tools.html#Fuzzapi

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool and improve its referencing.

Badges

The badge shows to your community that your are inventoried. It looks good but also shows you care about your project, that your tool is referenced.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make our open project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care. Else you can close this issue.

How to pass the cookie ?

i am passing cookie as:

options = {
  url: 'http://test.host.com/api/v2/credit_cards/123',
  cookies: 'PHPSESSID=98803810dagadabdjabdja',
  params: {
    name: 'First name'
  },
  method: ['GET'],
  headers: {
    'Host' => 'test.host.com',
    'User-Agent' => 'Mozilla Firefox',
    'Content-Type' => 'application/json',
  }
}

But when passing this options to Scan, i am getting undefined method `each_with_object' for #<String:0x007fe5fb9635c8>

Can you please help me in passing cookie in a right manner. @lalithr95 @Os-carsun

Thanks

Unable to install

I'm unable to install this tool. I am issuing the following commands:
└─$ git clone https://github.com/Fuzzapi/API-fuzzer.git
Cloning into 'API-fuzzer'...
remote: Enumerating objects: 372, done.
remote: Total 372 (delta 0), reused 0 (delta 0), pack-reused 372
Receiving objects: 100% (372/372), 63.16 KiB | 417.00 KiB/s, done.
Resolving deltas: 100% (186/186), done.

┌──(kali㉿kali)-[~/Downloads]
└─$ cd API-fuzzer

┌──(kali㉿kali)-[~/Downloads/API-fuzzer]
└─$ ls
API_Fuzzer.gemspec CODE_OF_CONDUCT.md lib Rakefile test
app config LICENSE.txt README.md
bin Gemfile payloads rules

┌──(kali㉿kali)-[/Downloads/API-fuzzer]
└─$ bin/console
Bundler could not find compatible versions for gem "bundler":
In Gemfile:
bundler (> 1.12)

Current Bundler version:
bundler (2.3.15)

Your bundle requires a different version of Bundler than the one you're running.
Install the necessary version with gem install bundler:1.17.3 and rerun bundler using console _1.17.3_

┌──(kali㉿kali)-[~/Downloads/API-fuzzer]
└─$ sudo gem install bundler:1.17.3
Successfully installed bundler-1.17.3
Parsing documentation for bundler-1.17.3
Done installing documentation for bundler after 1 seconds
1 gem installed

┌──(kali㉿kali)-[/Downloads/API-fuzzer]
└─$ bin/console 1.17.3
Bundler could not find compatible versions for gem "bundler":
In Gemfile:
bundler (> 1.12)

Current Bundler version:
bundler (2.3.15)

Your bundle requires a different version of Bundler than the one you're running.
Install the necessary version with gem install bundler:1.17.3 and rerun bundler using console _1.17.3_ _1.17.3_

Can you please advise? I'd really like to use this tool. I see it had originally came out 6 years ago so I'm thinking perhaps the tool isn't being updated.

API Fuzzer Tracking - TODO

• Information Leak which includes server information, version disclosures
• Header info disclosure which detects Clickjacking, lack of HSTS, X-XSS protection etc.
• XSS module which should detect all kinds of xss, which need to be done with regex match.
• SQL injection Mostly error based which will be based on regex match of responses.
• XXE check
• Open Redirect vulnerability check
• Privilege Escalation or IDOR specifically - Little complicated a generic approach need to be used.
• API rate limit check

/cc: @abhijeth @srini0x00