# artillery-plugin-fuzzer

> Fuzz your HTTP APIs with Artillery

Latest version **1.0.1** (published 2017-05-06) · MPL-2.0 license · 0 weekly downloads

## Install

```sh
npm install artillery-plugin-fuzzer
pnpm add artillery-plugin-fuzzer
yarn add artillery-plugin-fuzzer
bun add artillery-plugin-fuzzer
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.1 |
| Published | 2017-05-06 |
| First published | 2017-05-06 |
| Weekly downloads | 0 |
| License | MPL-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 1 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 60 |
| Author | Hassy Veldstra |
| Maintainers | hhvhhv |
| Keywords | fuzzer, fuzzing, security, artillery |

## Links

- npm: https://www.npmjs.com/package/artillery-plugin-fuzzer
- Repository: https://github.com/shoreditch-ops/artillery-plugin-fuzzer
- Homepage: https://github.com/shoreditch-ops/artillery-plugin-fuzzer#readme
- Issues: https://github.com/shoreditch-ops/artillery-plugin-fuzzer/issues
- npm.io page: https://npm.io/package/artillery-plugin-fuzzer

## Dependencies (1)

- [debug](https://npm.io/package/debug.md) ^2.6.6

## Recent versions

- 1.0.1 (latest) — 2017-05-06
- 1.0.0 — 2017-05-06

## README

# Artillery Fuzzer - easy fuzzing for HTTP APIs

This plugin makes it dead-easy to run some fuzz testing on your HTTP API with [Artillery](https://artillery.io).

Use it to send unexpected and weird payloads to your endpoints, see what breaks and fix it to make your application more **secure** and more **resilient**.

The payloads generated by this plugin are based on the awesome [Big List Of Naughty Strings](https://github.com/minimaxir/big-list-of-naughty-strings/).

## Usage

**Important**: this plugin requires Artillery `v1.6.0-0` or later.

Install the plugin with:

```
npm install artillery-plugin-fuzzer
```

Enable the plugin in your test script with:

```yaml
config:
  plugins:
    fuzzer: {}
```

Then just use the `{{ naughtyString }}` variable as you would any other variable in your scenario:

```yaml
- post:
    url: "/session"
    json:
      username: "{{ naughtyString }}"
      password: "secret"
```

A new value for the `naughtyString` variable will be generated for each new request in a scenario.

See the complete example in [`example.yaml`](example.yaml)

# Why?

Runnning a quick test with this plugin against your app's backend can help uncover bugs, security issues and QA problems.

## A Real World Example

Here's a sample payload sent by this plugin:

👾 🙇 💁 🙅 🙆 🙋 🙎 🙍

Something innocent like this could crash your application if it persists data in a MySOL database using the default settings. How? MySQL InnoDB engine uses the `latin1` encoding by default.

Did you set the `utf8` encoding on your database? You're still in trouble because those characters are outside the [BMP](https://en.wikipedia.org/wiki/Plane_(Unicode)#Basic_Multilingual_Plane) and you need to have specified `utf8mb4` and potentially made changes to your schema to be able to store them properly.

Modern software systems are incredibly complex. [If you haven't tried it, assume it's broken](https://landing.google.com/sre/book/chapters/testing-reliability.html).

Happy fuzzing!

# Roadmap

Sending [bnls](https://github.com/minimaxir/big-list-of-naughty-strings/) payloads is a good start for a fuzzer, but it's only the first small step. We want to make Artillery a great tool for API fuzz testing. Got an idea for this plugin? Share your feedback in [Issues](https://github.com/shoreditch-ops/artillery-plugin-fuzzer/issues).

# License

MPL 2.0

---
_Source: https://npm.io/package/artillery-plugin-fuzzer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._