HTTP Fuzz Testing

What you'll learn

• How to run simple fuzz tests on your HTTP endpoints

Overview

artillery-plugin-fuzzer makes it easy to run simple fuzz tests (also known as monkey tests) on HTTP endpoints.

The plugin lets you use Artillery to send a lot of unexpected and weird payloads to your API endpoints. You can then monitor your backend for exceptions, errors or crashes, and improve security and reliability of your system by fixing any issues uncovered.

The payloads generated by this plugin are based on the Big List Of Naughty Strings, which contains a large number of inputs that are more likely to trigger unexpected behavior in your software.

Usage

Install

npm install artillery-plugin-fuzzer

Use the plugin

Enable the plugin in your test script with:

config:
  plugins:
    fuzzer: {}

There is no further configuration required.

The plugin creates a unique naughtyString variable for each virtual user, which may be used in scenarios as normal, for example:

- post:
    url: "/session"
    json:
      username: "{{ naughtyString }}"
      password: "secret"

A new value for the naughtyString variable will be generated for each new request in a scenario.

Debugging

Set DEBUG=plugin:fuzzer when running your tests to print out the generated naughtyString variable used during the test run.

DEBUG=plugin:fuzzer artillery run my-script.yaml