REST API Fuzzing by Coverage Level Guided Blackbox Testing

Chung Hsuan Tsai, Shi Chun Tsai, Shih Kun Huang

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

1 Scopus citations

Abstract

With the growth of web applications, REST APIs have become the primary communication method between services. In order to ensure system reliability and security, software quality can be assured by effective testing methods. Black box fuzz testing is one of the effective methods to perform tests on a large scale. However, conventional black box fuzz testing generates random data without judging the quality of the input. We implement a black box fuzz testing method for REST APIs. It resolves the issues of blind mutations without knowing the effectiveness by Test Coverage Level feedback. We also enhance the mutation strategies by reducing the testing complexity for REST APIs, generating more appropriate test cases to cover possible paths. We evaluate our method by testing two large open-source projects and 89 bugs are reported and confirmed. In addition, we find 351 bugs from 64 remote API services in APIs.guru. The work is in https://github.com/iasthc/hsuan-fuzz.

Original languageEnglish
Title of host publicationProceedings - 2021 21st International Conference on Software Quality, Reliability and Security, QRS 2021
PublisherInstitute of Electrical and Electronics Engineers
Pages291-300
Number of pages10
ISBN (Electronic)9781665458139
DOIs
StatePublished - 2021
Event21st International Conference on Software Quality, Reliability and Security, QRS 2021 - Hainan, China
Duration: 6 Dec 202110 Dec 2021

Publication series

NameIEEE International Conference on Software Quality, Reliability and Security, QRS
Volume2021-December
ISSN (Print)2693-9177

Conference

Conference21st International Conference on Software Quality, Reliability and Security, QRS 2021
Country/TerritoryChina
CityHainan
Period6/12/2110/12/21

Keywords

  • Black-box testing
  • Fuzz testing
  • OpenAPI
  • REST API
  • Software quality
  • Test coverage level

Fingerprint

Dive into the research topics of 'REST API Fuzzing by Coverage Level Guided Blackbox Testing'. Together they form a unique fingerprint.

Cite this