Fuzz-testing HTTP endpoints

What you’ll learn

  • How to run simple fuzz tests on your HTTP endpoints

Overview

artillery-plugin-fuzzer makes it easy to run simple fuzz tests (also known as monkey tests) on HTTP endpoints.

The plugin lets you use Artillery to send a lot of unexpected and weird payloads to your API endpoints. You can then monitor your backend for exceptions, errors or crashes, and improve security and reliability of your system by fixing any issues uncovered.

The payloads generated by this plugin are based on the Big List Of Naughty Strings, which contains a large number of inputs that are more likely to trigger unexpected behavior in your software.

Usage

Install

npm install artillery-plugin-fuzzer

Use the plugin

Enable the plugin in your test script with:

config:
  plugins:
    fuzzer: {}

There is no further configuration required.

The plugin creates a unique naughtyString variable for each virtual user, which may be used in scenarios as normal, for example:

- post:
    url: "/session"
    json:
      username: "{{ naughtyString }}"
      password: "secret"

A new value for the naughtyString variable will be generated for each new request in a scenario.