Can I read REST-ler: Automatic Intelligent REST API Fuzzing on EtoBox?

REST-ler: Automatic Intelligent REST API Fuzzing by Atlidakis, Vaggelis; Godefroid, Patrice; Polishchuk, Marina is a scholarly article available to read on EtoBox.

What is REST-ler: Automatic Intelligent REST API Fuzzing about?

Cloud services have recently exploded with the advent of powerful cloud-computing platforms such as Amazon Web Services and Microsoft Azure. Today, most cloud services are accessed through REST APIs, and Swagger is arguably the most popular interface-description language for REST APIs. A Swagger specification describes how to access a cloud service through its REST API (e.g., what requests the service can handle and what responses may be expected). This paper introduces REST-ler, the first automatic intelligent REST API security-testing tool. REST-ler analyzes a Swagger specification and generates tests that exercise the corresponding cloud service through its REST API. Each test is defined as a sequence of requests and responses. REST-ler generates tests intelligently by (1) inferring dependencies among request types declared in the Swagger specification (e.g., inferring that "a request B should not be executed before a request A" because B takes as an input argument a resource-id x returned by A) and by (2) analyzing dynamic feedback from responses observed during prior test executions in order to generate new tests (e.g., learning that "a request C after a request sequence A;B i

Author

Atlidakis, Vaggelis; Godefroid, Patrice; Polishchuk, Marina

Published

2018

Language

EN