In this chapter, we discussed various kinds of techniques to achieve API fuzz security testing. We have introduced the use of FuzzDB and seclist for the sources of data input. In addition, we also demonstrated the use of Radamsa, which allows us to dynamically generate fuzz data based on a specified data sample.
For the API fuzz testing, we also demonstrated some automation frameworks and tools such as JMeter, Selenium/DDT, Robot Framework DDT, 0d1n, Wfuzz, and integration with ZAP. During API fuzz testing, it's recommended to apply ZAP as a proxy to identify security issues. We demonstrated four different technical approaches.
Approach 1 is to do the testing using Wfuzz. It can do the fuzz testing with multiple parameters, and output a summary of response codes and the number of lines, words, and chars of every HTTP response. Wfuzz testing is a good candidate for...