RESTler
RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI/Swagger specification, RESTler analyzes its entire specification, and then generates and executes tests that exercise the service through its REST API.
RESTler intelligently infers producer-consumer dependencies among request types from the Swagger specification. During testing, it checks for specific classes of bugs and dynamically learns how the service behaves from prior service responses. This intelligence allows RESTler to explore deeper service states reachable only through specific request sequences and to find more bugs.
RESTler is described in these peer-reviewed research papers:
- RESTler: Stateful REST API Fuzzing (ICSE'2019)
- Checking Security Properties of Cloud Service REST APIs (ICST'2020)
- Differential Regression Testing for REST APIs (ISSTA'2020)
- Intelligent REST API Data Fuzzing (FSE'2020)
If you use RESTler in your research, please cite the (default) ICSE'2019 paper (BibTeX).
RESTler was created at Microsoft Research and is still under active development.
Build Status
Setting up RESTler
RESTler was designed to run on 64-bit machines with Windows or Linux. Experimental support for macOS is also enabled.
Build instructions
Prerequisites: Install Python 3.8.2 and
.NET 5.0, for your appropriate OS.
Create a directory where you'd like to place the RESTler binaries:
mkdir restler_bin
Switch to the repo root directory and run the following Python script:
python ./build-restler.py --dest_dir <full path to restler_bin above>
Note: if you get nuget error NU1403 when building, a quick workaround is to clear your cache with this command
dotnet nuget locals all --clear
Binary-drop instructions
RESTler binary drops are coming soon.
Prerequisites: Install Python 3.8.2 and
.NET 5.0 or higher, for your appropriate OS.
