WFC/WFD: Web Fuzzing Commons, Dataset and Guidelines to Support Experimentation in REST API Fuzzing

• URL: http://arxiv.org/abs/2509.01612v1
• Date: Mon, 01 Sep 2025 16:44:59 GMT
• Title: WFC/WFD: Web Fuzzing Commons, Dataset and Guidelines to Support Experimentation in REST API Fuzzing
• Abstract summary: We present Web Fuzzing Commons (WFC) and Web Fuzzing dataset (WFD)<n>WFC is a set of open-source libraries and schema definitions to declaratively specify authentication info and catalog different types of faults that fuzzers can automatically detect.<n>WFD is a collection of 36 open-source APIs with all necessary scaffolding to easily run experiments with fuzzers, supported by WFC.<n>We compare EvoMaster with other state-of-the-art tools such as ARAT-RL, EmRest, LLamaRestTest, RESTler, andthesis.
• Score: 5.029088739904413
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Fuzzing REST APIs is an important research problem, with practical applications and impact in industry. As such, a lot of research work has been carried out on this topic in the last few years. However, there are three major issues that hinder further progress: how to deal with API authentication; how to catalog and compare different fault types found by different fuzzers; and what to use as case study to facilitate fair comparisons among fuzzers. To address these important challenges, we present Web Fuzzing Commons (WFC) and Web Fuzzing Dataset (WFD). WFC is a set of open-source libraries and schema definitions to declaratively specify authentication info and catalog different types of faults that fuzzers can automatically detect. WFD is a collection of 36 open-source APIs with all necessary scaffolding to easily run experiments with fuzzers, supported by WFC. To show the usefulness of WFC/WFD, a set of experiments is carried out with EvoMaster, a state-of-the-art fuzzer for Web APIs. However, any fuzzer can benefit from WFC and WFD. We compare EvoMaster with other state-of-the-art tools such as ARAT-RL, EmRest, LLamaRestTest, RESTler, and Schemathesis. We discuss common pitfalls in tool comparisons, as well as providing guidelines with support of WFC/WFD to avoid them.

Related papers

• Using OAI Overlay to Enhance REST API Fuzzing [34.90666545902245]
  The OpenAPI Initiative (OAI) standard Overlay might be a solution to this problem.<n>We have extended the state-of-the-art fuzzer EvoMaster to support Overlay files.<n>Our industrial results show that Overlay is a viable solution to better enable black-box fuzzing of REST APIs in industry.
  arXiv  Detail & Related papers  (2026-07-05T14:14:38Z)
• Enhancing REST API Fuzzing with Access Policy Violation Checks and Injection Attacks [5.029088739904413]
  We propose a series of novel automated oracles aimed at detecting violations of access policies in REST APIs.<n>These oracles can be integrated into existing fuzzers, in which, once the fuzzing session is completed, a security testing'' phase is executed to verify these oracles.<n>Our novel techniques are integrated as an extension of EvoMaster, a state-of-the-art open-source fuzzer for REST APIs.
  arXiv  Detail & Related papers  (2026-04-01T10:05:23Z)
• WuppieFuzz: Coverage-Guided, Stateful REST API Fuzzing [0.0]
  WuppieFuzz is an open-source REST API fuzzer built on LibAFL.<n>It supports white-box, grey-box and black-box fuzzing.
  arXiv  Detail & Related papers  (2025-12-17T16:05:39Z)
• HAODiff: Human-Aware One-Step Diffusion via Dual-Prompt Guidance [71.5820853722963]
  Human-centered images often suffer from severe generic degradation during transmission and are prone to human motion blur (HMB)<n>We design a degradation pipeline that simulates the coexistence of HMB and generic noise, generating synthetic degraded data to train our proposed HAODiff.<n>For fair evaluation, we introduce MPII-Test, a benchmark rich in combined noise and HMB cases.
  arXiv  Detail & Related papers  (2025-05-26T09:24:11Z)
• Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidence [56.09494651178128]
  Retrieval models are commonly used in Information Retrieval (IR) applications, such as Retrieval-Augmented Generation (RAG)<n>We quantify the impact of biases, such as a preference for shorter documents, on retrievers like Dragon+ and Contriever.<n>We uncover major vulnerabilities, showing retrievers favor shorter documents, early positions, repeated entities, and literal matches, all while ignoring the answer's presence!
  arXiv  Detail & Related papers  (2025-03-06T23:23:13Z)
• Your Fix Is My Exploit: Enabling Comprehensive DL Library API Fuzzing with Large Language Models [49.214291813478695]
  Deep learning (DL) libraries, widely used in AI applications, often contain vulnerabilities like overflows and use buffer-free errors.<n>Traditional fuzzing struggles with the complexity and API diversity of DL libraries.<n>We propose DFUZZ, an LLM-driven fuzzing approach for DL libraries.
  arXiv  Detail & Related papers  (2025-01-08T07:07:22Z)
• A Multi-Agent Approach for REST API Testing with Semantic Graphs and LLM-Driven Inputs [46.65963514391019]
  We present AutoRestTest, the first black-box tool to adopt a dependency-embedded multi-agent approach for REST API testing.<n>Our approach treats REST API testing as a separable problem, where four agents collaborate to optimize API exploration.<n>Our evaluation of AutoRestTest on 12 real-world REST services shows that it outperforms the four leading black-box REST API testing tools.
  arXiv  Detail & Related papers  (2024-11-11T16:20:27Z)
• G-Fuzz: A Directed Fuzzing Framework for gVisor [48.85077340822625]
  G-Fuzz is a directed fuzzing framework for gVisor. G-Fuzz has been deployed in industry and has detected multiple serious vulnerabilities.
  arXiv  Detail & Related papers  (2024-09-20T01:00:22Z)
• FuzzCoder: Byte-level Fuzzing Test via Large Language Model [46.18191648883695]
  We propose to adopt fine-tuned large language models (FuzzCoder) to learn patterns in the input files from successful attacks. FuzzCoder can predict mutation locations and strategies locations in input files to trigger abnormal behaviors of the program.
  arXiv  Detail & Related papers  (2024-09-03T14:40:31Z)
• Fuzzing Frameworks for Server-side Web Applications: A Survey [3.522950356329991]
  This study reviews the state-of-the-art fuzzing frameworks for testing web applications through web API. We collect papers from seven online repositories of peer-reviewed articles over the last ten years.
  arXiv  Detail & Related papers  (2024-06-05T12:45:02Z)
• Fact Checking Beyond Training Set [64.88575826304024]
  We show that the retriever-reader suffers from performance deterioration when it is trained on labeled data from one domain and used in another domain. We propose an adversarial algorithm to make the retriever component robust against distribution shift. We then construct eight fact checking scenarios from these datasets, and compare our model to a set of strong baseline models.
  arXiv  Detail & Related papers  (2024-03-27T15:15:14Z)
• Benchmarking Deep Learning Fuzzers [11.118370064698869]
  We run three state-of-the-art DL fuzzers, FreeFuzz, DeepRel, and DocTer, on the benchmark by following their instructions. We find that these fuzzers are unable to detect many real bugs collected in our benchmark dataset. Our systematic analysis further identifies four major, broad, and common factors that affect these fuzzers' ability to detect real bugs.
  arXiv  Detail & Related papers  (2023-10-10T18:09:16Z)
• Advanced White-Box Heuristics for Search-Based Fuzzing of REST APIs [3.3714461095047743]
  Currently, EvoMaster is the only existing tool that supports white-box fuzzing of REST APIs. We provide a series of novel white-box fuzzs, including for example how to deal with under-specified constrains in API schemas. Our novel techniques are implemented as an extension to our open-source, search-based fuzzer EvoMaster.
  arXiv  Detail & Related papers  (2023-09-15T12:39:01Z)
• HOPPER: Interpretative Fuzzing for Libraries [6.36596812288503]
  HOPPER can fuzz libraries without requiring any domain knowledge. It transforms the problem of library fuzzing into the problem of interpreter fuzzing.
  arXiv  Detail & Related papers  (2023-09-07T06:11:18Z)
• torchgfn: A PyTorch GFlowNet library [56.071033896777784]
  torchgfn is a PyTorch library that aims to address this need. It provides users with a simple API for environments and useful abstractions for samplers and losses.
  arXiv  Detail & Related papers  (2023-05-24T00:20:59Z)
• Deep Learning for Cross-Domain Few-Shot Visual Recognition: A Survey [33.00835033658241]
  Few-shot learning enables models to perform the target tasks with very few labeled examples.<n>To overcome this limitation, Cross-domain few-shot learning has gained attention.<n>This paper presents the first comprehensive review of Cross-domain Few-shot Learning.
  arXiv  Detail & Related papers  (2023-03-15T12:18:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.