Fuzzing tests software by sending varied, malformed, or unexpected inputs and observing whether it crashes, returns errors, or behaves unexpectedly. For APIs, fuzzing checks whether the implementation conforms to its specification and reveals how attackers might abuse weak input handling. section 1.2.2 section 12.3
Use fuzzing as part of API implementation and testing:
- Generate test cases from an API specification, including valid and invalid payloads. section 1.2.2 section 12.3
- Run tests against a live server with authentication when protected endpoints require it. section 12.3
- Inspect failures for server errors, status-code or schema mismatches, ignored authentication, and rejected negative data. section 12.3
- Use the findings to correct API drift, validate inputs, and prevent crashes or unexpected behavior. section 1.5 section 12.3
Finding an unhandled payload
A Schemathesis test sends a registration request whose phone_number contains a NUL byte. The API reaches the database and produces a PostgreSQL DataError instead of handling the input safely, exposing a defect for remediation. section 12.3
Figure 1.6 Security by design fits into every step of the API development cycle. It encourages us to approach design, implementation, testing, and operations from a security point of view.
Use the security-by-design cycle to place fuzzing after implementation while continuing security checks through design, testing, and operations. section 1.5
