fuzzer - HTTP Fuzz Testing

Overview

artillery-plugin-fuzzer (opens in a new tab) makes it easy to run simple fuzz tests (opens in a new tab) (also known as monkey tests (opens in a new tab)) on HTTP endpoints.

The plugin lets you use Artillery to send a lot of unexpected and weird payloads to your API endpoints. You can then monitor your backend for exceptions, errors or crashes, and improve security and reliability of your system by fixing any issues uncovered.

The payloads generated by this plugin are based on the Big List Of Naughty Strings (opens in a new tab), which contains a large number of inputs that are more likely to trigger unexpected behavior in your software.

Usage

Install

npm install artillery-plugin-fuzzer

Use the plugin

Enable the plugin in your test script with:

config:
  plugins:
    fuzzer: {}

There is no further configuration required.

The plugin creates a unique naughtyString variable for each virtual user, which may be used in scenarios as normal, for example:

- post:
    url: "/session"
    json:
      username: "{{ naughtyString }}"
      password: "secret"

A new value for the naughtyString variable will be generated for each new request in a scenario.

Debugging

Set DEBUG=plugin:fuzzer when running your tests to print out the generated naughtyString variable used during the test run.

DEBUG=plugin:fuzzer artillery run my-script.yaml