Trying RESTler Fuzzer
By: Arthur Pires
Tags: Microsoft, Fuzzing, Rest Api, Restler

What is RESTler?

It’s a recently released Fuzzy made by the Microsoft, after some repercussion in the academy it comes to open source.

As said on it's repository:

RESTler is a stateful REST API fuzzing tool for automatically testing… For a given cloud service with an OpenAPI/Swagger specification, RESTler analyzes its entire specification, and then generates and executes tests that exercise the service through its REST API.

About the setup

There is a feels pre requirements to use it, you need to have:

Important to know that the documentation says that it could be used a version higher of the .NET SDK, but after some tests this seems to be not true.

After the pre requirements, you just need to execute with a proper exit folder:

$ python ./build-restler.py --dest_dir <full path to restler_bin above>

And it should be working! Or is what I was thinking before got this error:

/usr/share/dotnet/sdk/5.0.100/NuGet.targets(131,5): error NU1004: The packages lock file is inconsistent with the project dependencies so restore can’t be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit — force-evaluate option to run restore to update the lock file.

At this commit the lock file is not updated, so it causes the script to fail. After some days, I just update the repository again, it seems to have new commits with a new adjust on it, precisely this commit.

Docker is always the solution

So we could the that the setup still unstable, so I have decided to try to resolve it generating a Docker to stabilize the enviroment, so I am putting the Dockerfile here:

FROM mcr.microsoft.com/dotnet/sdk:3.1.404-focal RUN apt-get update && apt-get install -y python3 git && ln -s /usr/bin/python3 /usr/bin/python RUN mkdir /root/bin && mkdir /root/dir RUN git clone https://github.com/microsoft/restler-fuzzer.git /root/restler-fuzzer RUN cd /root/restler-fuzzer && git checkout ad867673db70c6f39807a57314a89e86e2346ece RUN python /root/restler-fuzzer/build-restler.py — dest_dir /root/bin RUN ln -s /root/bin/restler/Restler /usr/bin/restler WORKDIR /root/dir CMD restler

Setting up the right version of the python, dotnet-sdk and specifing the git commit to avoid possible oscilation in the setup.

With this Dockerfile in the folder, you should just do it:

$ docker build -t restler .

How should I use it?

We will focus on the use with docker, you could try to run using:

$ docker run -it — rm restler restler <restler_params>

To compile swagger:

$ docker run -it — rm -v $(pwd):/root/dir -v <swagger_path>:/root/dir/swagger.json restler restler compile — api_spec /root/dir/swagger.json

To run fuzzing tests with a local service:

$ docker run -it — rm -v <Compile_folder>:/root/dir/Compile restler restler fuzzer — grammar_file Compile/grammar.json — host host.docker.internal — target_port <your_service_port> — dictionary_file Compile/dict.json

The Compile folder is generated by the compile command, with the files dict.json and grammar.json. So with only the service's swagger you could run fuzzing tests on it.

Personal tests with it

I have tried to run tests with the demo server present in the repository, but none of it seems to be worked. The compile command have worked, I have succeded to generate a gramma files, you could reproduce it running:

$ docker run -it — rm -v $(pwd):/root/dir restler restler compile — api_spec /root/restler-fuzzer/demo_server/swagger.json

With the generated files I have tried to run the fuzz or test commands, without success and I don't really know why. The program always response with:

ERROR: Restler engine failed. See logs in /root/dir/Test directory for more information

But I couldn't find the cause in the log files generated in the folder. I am probably doing something wrong, but the documentation and the erros don't give to me a proper answer about it.

Conclusion

It seems to be a great tool to tests services, but it seems to be a bit difficult yet to use it. The documentation is not too well done, it took me a while to understand how to use it, since I am not familiar with .Net core and F#. Also there is an official Docker repository, but the image seems to be not available at the moment that I write this article.

So, It's promising tool, but not sure if I want to use it now. Maybe we should wait to get more stable and get more support from Microsoft to start to use it.