apifuzz 0.1.1

Robust API fuzzing CLI with strict failure detection
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

# apifuzz

Pure Rust API fuzzer. Generates requests from OpenAPI specs (JSON or YAML)
using a multi-phase strategy with 6 response validation checks (5xx detection,
status conformance, negative testing, response time, schema validation,
content-type conformance).

## Install

```bash
cargo install --path crates/apifuzz-cli
```

## Usage

```bash
apifuzz init                    # create .apifuzz.toml
apifuzz fuzz --level quick      # run (quick/normal/heavy)
apifuzz fuzz -n 200             # exact iteration count
apifuzz fuzz --dry-run          # preview plan without HTTP
apifuzz fuzz --dump             # save all req/res to JSONL
apifuzz fuzz --stop-on-failure  # halt on first failure
apifuzz guide                   # full usage reference
```

## Try with Examples

Example target servers with intentional bugs are included for testing.

### Python (FastAPI)

```bash
cd examples/python-server
pip install fastapi uvicorn pydantic[email]
python main.py &                # starts on :8080
apifuzz fuzz -c apifuzz.toml --level quick
```

### Node.js (Express)

```bash
cd examples/node-server
npm install
node server.js &                # starts on :3000
apifuzz fuzz -c apifuzz.toml --level quick
```

Each example directory contains multiple config variants
(`apifuzz-probes.toml`, `apifuzz-boundary.toml`, etc.) for different
fuzzing scenarios.

## Fuzzing Phases

| Phase | Strategy | Source |
|-------|----------|--------|
| 0 | Custom probes | `[[probes]]` in TOML |
| 1 | Boundary values | Auto from schema |
| 1b | Type confusion | Wrong types injected |
| 2 | Near-boundary random | Boundary +/- noise |
| 3 | Full random | Schema-conformant |

## Documentation

- **[Usage Guide](crates/apifuzz-cli/docs/GUIDE.md)** - Config, phases, probes, CI, exit codes
- `apifuzz guide` - Same content from CLI (works offline)

## Project Structure

```
crates/
  apifuzz-core/     # Types, verdict logic, config
  apifuzz-runner/   # Fuzzing engine (datagen, HTTP, phases)
  apifuzz-cli/      # CLI (clap)
crates/apifuzz-cli/docs/
  GUIDE.md          # Canonical usage guide (embedded in binary)
examples/
  python-server/    # FastAPI buggy API (port 8080)
  node-server/      # Express buggy API (port 3000)
```