Webtica API Workflow Testing Toolkit

NOW OPEN SOURCE
hero-image
WHY SERIOUS API WORKFLOW SCANNING MATTERS

"Predictable Session ID" @ Step 8 May Lead to Massive Data Breach

content-image

Legacy Tools Test & Scan Step 1 Only ...

 Understand RESTful APIs;  support multi-step workflow;  Identify sensitive data fields;  Support smart fuzzing; and  Test flaws in authorization.
hackers find the software vulnerabilities through fuzzing

Smart vs Dumb Fuzzing

SMART FUZZING

More accurate results

  • Smart fuzzers generate randomized data valid enough to pass program parser checks, get deep into the program logic, and potentially trigger edge cases and find bugs.

  • A mutation-based fuzzer takes valid inputs and generates a collection of inputs by changing (mutating) the valid inputs.

  • A generation-based fuzzer analyses the provided valid input structure and generates entirely new data that matches the valid one from the structure perspective.

DUMB FUZZING

Results of little use

  • Dumb fuzzers produce completely random input without matching the shape of the expected input or generated to match a valid input.

  • Dumb fuzzers, sometimes, tests a parser than your program.

  • Dumb fuzzers won’t be able to begin the execution of the application logic and identify potential bugs in that area of the code due to the wholly randomized input that does not match the valid input.