{"id":35303584,"url":"https://github.com/weixian-zhang/fuzzie","last_synced_at":"2025-12-30T17:00:08.925Z","repository":{"id":42187632,"uuid":"510618088","full_name":"weixian-zhang/Fuzzie","owner":"weixian-zhang","description":" A VSCode GUI-based fuzzer for Rest API and GraphQL","archived":false,"fork":false,"pushed_at":"2024-03-06T09:07:05.000Z","size":114354,"stargazers_count":5,"open_issues_count":9,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2024-03-06T10:29:44.485Z","etag":null,"topics":["fuzzing","python3","rest-api","security","vscode-extension"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/weixian-zhang.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-07-05T06:43:19.000Z","updated_at":"2024-03-06T10:29:48.050Z","dependencies_parsed_at":"2024-03-06T10:40:23.582Z","dependency_job_id":null,"html_url":"https://github.com/weixian-zhang/Fuzzie","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/weixian-zhang/Fuzzie","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weixian-zhang%2FFuzzie","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weixian-zhang%2FFuzzie/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weixian-zhang%2FFuzzie/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weixian-zhang%2FFuzzie/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/weixian-zhang","download_url":"https://codeload.github.com/weixian-zhang/Fuzzie/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weixian-zhang%2FFuzzie/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28129964,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-30T02:00:05.476Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fuzzing","python3","rest-api","security","vscode-extension"],"created_at":"2025-12-30T17:00:03.277Z","updated_at":"2025-12-30T17:00:08.914Z","avatar_url":"https://github.com/weixian-zhang.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Fuzzie\n[\u003cimg src=\"https://badgen.net/badge/vs-marketplace/0.16.0-preview/green\" /\u003e](https://marketplace.visualstudio.com/items?itemName=wxz.wxz-fuzzie)\n\nFuzzie is a simple grey-box fuzz testing tool available as VSCode extension for fuzz testing REST API and GraphQL.  \nThe ability to fuzz test right in VSCode brings about several benefits:\n\n* As early as while debugging APIs in VSCode running on localhost, you can concurrently use Fuzzie to fuzz test your APIs.  \n  As Fuzzie also sends random unpredictable data, you can catch common erros from unhandled input parameters early.\n* fuzz tests guided by an intuitive WebView\n* able to fuzz test any parts of a HTTP message by creating your request messages with built-in wordlist, functions and variables\n* Being available in VSCode allows developers to conveniently fuzz test anytime without prior knowledge of fuzzing\n\n## What Information Does Fuzzie Collects?\n\n* Fuzzie does not collect personal data\n* Fuzzie collects all HTTP Request and Response related data of the user's specified test-target Web APIs and Websites.\n  If authentication tokens and keys are supplied to Fuzzie to be able to authenticate itself to the targetted Web APIs and Websites, Fuzzie stores these authentication tokens and keys.\n  All data including authentication token, keys, HTTP request and response collected, are stored locally within VSCode extension folder. The data is not send over to any remote servers.\n \n\n### *Things to Note    \n\n* Depending on [wordlist type](#2-write-http-request-messages), Fuzzie can send malicious strings from [SecList](https://github.com/danielmiessler/SecLists), recommend to use Fuzzie in test environments only\n* requires Python 3.10 and above\n* Fuzzie uses port 50001  \n  fuzzer engine listens on http://localhost:50001 serving requests from webview\n* Fuzzie uses sqlite internally to store all data, when upgrading to a newer extension version, previous data will not be retained\n* On VSCode first launch, Fuzzie can take up to 7-9 secs to start up\n\n\u003cbr /\u003e  \n\n### Content  \n* [Launching Fuzzie](#launching-fuzzie)\n* [Using Fuzzie](#using-fuzzie )\n* [How to write HTTP Request Message ](#2-writing-http-request-messages)  \n  * [Variable](#variables)\n  * [Wordlist Types](#wordlist-types)\n  * [Functions](#functions)\n* [More examples of Request Messages](#21-request-message-examples)\n\n\u003cbr /\u003e \n\n### Launching Fuzzie  \n\nOpen VSCode command palette (Ctrl + Shift + P) and search for \"Fuzzie\"  \n\u003cimg src=\"https://github.com/weixian-zhang/Fuzzie/blob/main/doc/tutorial/how%20to%20launch%20fuzzie.png\" /\u003e\n\n\n### Using Fuzzie \n\nFuzzie VSCode extension provides a webview for you to perform everything from writing request messages to discover API and GraphQL, to fuzzing and analyzing test result, all in a single place.  \n\n\u003cbr /\u003e \n\n![Animation - Copy](https://github.com/weixian-zhang/Fuzzie/blob/main/doc/fuzzie-webview-walkthrough.gif)\n\n\u003cbr /\u003e  \n\n#### 1. Webview Navigation  \n\n\u003cimg src =\"https://github.com/weixian-zhang/Fuzzie/blob/main/doc/tutorial/tutorial-fuzzie-webview.png\" /\u003e\n\n#### 2. Start by creating a  new API Fuzz Context\n\nA Fuzz Context contains a list of cohesive \"test cases\" created by writing [HTTP Request Messages](#http-write-request-messages).  \nEach test case contains HTTP verb, domain name, port, path, querystring, headers and body and Fuzzie make HTTP requests against all test cases in a Fuzz Context. \n\n\u003cimg src=\"https://github.com/weixian-zhang/Fuzzie/blob/main/doc/tutorial/create-new-api-context.png\" /\u003e  \n\n#### 2. Writing HTTP Request Messages  \n\nYour REST and GraphQL target endpoints are described by writing Request Messages.  \nThe concept of Request Message is fully inspired by [Hau Chao's VSCode Rest Client project](https://github.com/Huachao/vscode-restclient#select-request-text).  \n\n```\n//this is a comment\n# and this is comment too\n\n{VERB} {url}\n{headers}\n\n{body}\n```\n\nIn a request message, you can \u003cb\u003ereplace any part of path, querystring, header, body with Fuzzie's [Wordlists or Functions](#wordlist-types)\u003c/b\u003e.  \nBy replacing parameter with {{ wordlist type }} , during fuzzing, Fuzzie will replace the wordlist with fuzz data depending on the type of wordlist.  \n  * wordlist type = fuzz data type e.g: sql-inection string, xss string, hacked usernames and password and more\n  * function = transform, iterate or randomize your provided input\nfor example:\n\n```\nGET https://httpbin.org/get\n?name={{username}}\n\u0026address={{string}}\n\u0026order=5\n\u0026mode={{string}}\nContent-Type: application/xml\nAuthorization: {{ string }}\nCustomHeader-1: {{ digit }}\nCustomHeader-2: {{ filename }}\nCustomHeader-3: {{ username }}\n```\n\n{{ wordlist type }} will be replaced with fuzz data during fuzzing  \n```\nGET https://httpbin.org:443/get?name=!root\u0026address=undefined\u0026order=5\u0026mode=select user from sysibm.sysdummy1;\n\nContent-Type:application/xml\nAuthorization:IF(SUBSTR(@@version,1,1)\u003c5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1))/*'XOR(IF(SUBSTR(@@version,1,1)\u003c5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),SLEEP(1)))OR'|XOR(IF(SUBSTR(@@version,1,1)\u003c5,BENCHMARK(2000000,SHA1(0xDE7EC71F1)),​SLEEP(1)))OR*/\nCustomHeader-1:-£100000\nCustomHeader-2:HRUZgKCQcM7deZue.class\nCustomHeader-3:$ALOC$\nUser-Agent:fuzzie\n```\n\n### Variables  \n\nstarting at version 0.15-preview, Fuzzie supports Variables  \n\n```\n{% set url = 'https://httpbin.org' %}\n{% set name = 'Kean' %}\n{% set address = '182 Cecil St, #13-01 069547' %}\n\n###\n\nGET {{ url }}/get\n?name={{ name }}\n\u0026address={{ address }}\nContent-Type: application/xml\nAuthorization: {{ string }}\nCustomHeader-1: {{ digit }}\nCustomHeader-2: {{ filename }}\nCustomHeader-3: {{ username }}\n\n```\n\nEdit variables in API Context  \n![image](https://user-images.githubusercontent.com/43234101/235344075-ce5a921e-3945-44d6-a644-6639eea5e5db.png)\n\n### Wordlist Types\nThe following are built-in wordlist-types, more will be added in future  \nType = wordlist provides data  \nType = function acts on your provided custom data\n| WordList Type | Is Primitive wordlist type | file upload | Description |\n| ------------- |-------------| -------------| ------------- |\n| {{ string }} |  yes | no | naughty strings from [minimaxir/big-list-of-naughty-strings](https://github.com/minimaxir/big-list-of-naughty-strings) | \n| {{ xss }} | yes | no | cross-site scripting strings from [danielmiessle/seclist](https://github.com/danielmiessler/SecLists) |\n| {{ sqlinject }} | yes | no | sql-injection strings from danielmiessle/seclist |\n| {{ bool }} | yes | no | boolean values and something naughty |\n| {{ digit }} | yes | no | Integers, floats and something naughty |\n| {{ char }} | yes | no | naughty chars |\n| {{ image }} |  no | yes | DALL-E images and a mix of naughty payloads (same as {{ file }} ) from danielmiessle/seclist | \n| {{ pdf }} |  no | yes | Fuzzie generated fake PDF with a mix of naughty payloads (same as {{ file }} ) from danielmiessle/seclist |\n| {{ file }} |  no | yes | naughty [payload](https://github.com/danielmiessler/SecLists/tree/master/Payloads) from danielmiessle/seclist |\n| \u003cbr\u003e{{\u003cbr\u003e '\u003cbr\u003ecustom file content\u003cbr\u003e'\u003cbr\u003e \u0026#124; myfile('filename.csv')\u003cbr\u003e }} | no | yes | Custom file content within single quite '...' are uploaded as file\u003cbr\u003e{{\u003cbr\u003e'\u003cbr\u003ethis is a file content\u003cbr\u003e{{string}} {{username}}\u003cbr\u003e'\u003cbr\u003e \u0026#124; myfile(\"data.json\")\u003cbr\u003e}}  |\n| {{ datetime }} | yes | no | date + time | \n| {{ date }} | yes | no | date only |\n| {{ time }} | yes | no | time only |\n| {{ username }} | yes | no | hacked [usernames](https://github.com/danielmiessler/SecLists/tree/master/Usernames) from danielmiessler seclist |\n| {{ password }} | yes | no | hacked [password](https://github.com/danielmiessler/SecLists/tree/master/Passwords) from danielmiessler seclist \n| {{ filename }} | yes | no | random file name and extensions |  wordlist |\n| {{ httppath }} | yes | no | discover [directories and files](https://github.com/danielmiessler/SecLists/tree/master/Discovery) from danielmiessler seclist |\n\n### Functions  \n\n| WordList Type | Description |\n| ------------- |-------------|\n| {{ numrange(start, end) }} | increment number by 1 from start to end. \u003cbr\u003eExample numrange(1, 5000): result is 1, 2, 3,...4999, 5000 |\n| {{ 'a quick brown fox' \u0026#124; \u003cb\u003emutate\u003c/b\u003e }} | input will be mutated |\n| {{ ['a', 'list', 'of', 'items' ]  \u0026#124; \u003cb\u003erandom\u003c/b\u003e }} | returns a random item from your list |\n| {{ \u003cbr\u003e'single string to be base64 encoded' \u0026#124; \u003cb\u003ebase64e\u003c/b\u003e }}\u003cbr\u003e \u003cbr\u003e{{ ['list', 'of', 'items', 'to be base64 encoded'] \u0026#124; \u003cb\u003ebase64e\u003c/b\u003e }}\u003cbr\u003e  | base64 encodes your input, or if a list is supplied, randomly pick an item and encodes it |\n| {{ \u003cbr\u003e'base64 encoded string to be decoded' \u0026#124; \u003cb\u003ebase64d\u003c/b\u003e }}\u003cbr\u003e \u003cbr\u003e{{ ['list', 'of', 'encoded', 'items', 'to be base64 decoded'] \u0026#124; \u003cb\u003ebase64d\u003c/b\u003e }}\u003cbr\u003e  | base64 encodes your input, or if a list is supplied, randomly pick an item and encodes it |\n\n\u003cbr\u003e \n\n\n#### 2.1 Request Message Examples  \n\nRequest message syntax follows [VSCode Rest Client](https://marketplace.visualstudio.com/items?itemName=humao.rest-client) closely.  \n\"Samples\" drop-down button allows you to load different samples of request message where you can modify to suit your scenario  \n\n* GraphQL request message has to include a special header: X-REQUEST-TYPE: GraphQL\n* comments: // or #\n* \\#\\#\\# use for dividing request messages\n* for myfile and mutate wordlists, your text must be within single quotes ' your string here'\n  * single quotes within your custom string needs to be escaped with \\.  \n  For example below: **Don\\\\'t**\n  ```\n  \u003cnote\u003e\n    \u003cto\u003e{{ username }}\u003c/to\u003e\n    \u003cfrom\u003e{{ username }}\u003c/from\u003e\n    \u003cheading\u003e{{ 'Reminder' | mutate }}\u003c/heading\u003e\n    \u003cbody\u003e{{ 'Don't forget me this weekend!' | mutate }}\u003c/body\u003e\n  \u003c/note\u003e\n  ```\n\n\u003cimg src=\"https://github.com/weixian-zhang/Fuzzie/blob/main/doc/tutorial/request-message-syntax-1.png\" /\u003e  \n\n##### GET\n\n```\nGET https://httpbin.org/get\n?name={{username}}\n\u0026address={{string}}\n\u0026order=5\n\u0026mode={{string}}\n\n```\n\n##### GET with headers  \n```\nGET https://httpbin.org/get\n?name={{username}}\n\u0026address={{string}}\n\u0026order=5\n\u0026mode={{string}}\nContent-Type: application/xml\nAuthorization: {{ string }}\nCustomHeader-1: {{ digit }}\nCustomHeader-2: {{ filename }}\nCustomHeader-3: {{ username }}\n```\n\n##### Upload files  \n\nPOST image\n\n```\nPOST https://httpbin.org/post HTTP/1.1\n\n{{ image('option-file-name.png') }}\n```\n\nPOST PDF\n\n```\nPOST https://httpbin.org/post HTTP/1.1\n\n{{ pdf('option-file-name.pdf') }}\n```  \n\nPOST [naughty payloads](https://github.com/danielmiessler/SecLists/tree/master/Payloads)\n\n```\nPOST https://httpbin.org/post HTTP/1.1\n\n{{ file('option-file-name.log') }}\n```\n\nPOST \u003cb\u003eyour custom file content\u003c/b\u003e for example a CSV file\n\n```\nPOST https://httpbin.org/post\nx-ms-blob-type: BlockBlob\n\n{{\n'\n\nstring,username,password,filename,datetime\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n{{string}},{{username}},{{password}},{{filename}},{{datetime}}\n\n'\n| myfile(\"batchfile.log\")\n}}\n```  \n\n##### POST XML\n\n```\nPOST https://httpbin.org/post\nContent-Type: application/xml\n\n{\n\u003cnote\u003e\n    \u003cto\u003e{{ username }}\u003c/to\u003e\n    \u003cfrom\u003e{{ username }}\u003c/from\u003e\n    \u003cheading\u003e{{ 'Reminder' | mutate }}\u003c/heading\u003e\n    \u003cbody\u003e{{ 'Don't forget me this weekend!' | mutate }}\u003c/body\u003e\n\u003c/note\u003e\n}\n```\n\n##### POST JSON  \n\n```\nPOST https://httpbin.org/post\nContent-Type: application/json\n\n{\n    \"name\": \"john doe\",\n    \"info\": {{ 'this custom input will be mutated by fuzzie' | mutate }}\n}\n```  \n\n##### GraphQL  \n\n```\nPOST https://spacex-production.up.railway.app/\nX-REQUEST-TYPE: GraphQL\n\n{\n    launchesPast(limit: 10) {\n      mission_name\n      launch_date_local\n      launch_site {\n        site_name_long\n      }\n      links {\n        article_link\n        video_link\n      }\n      rocket {\n        rocket_name\n      }\n    }\n  }\n```\n\n\n\n\n\n\n\n\n    \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fweixian-zhang%2Ffuzzie","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fweixian-zhang%2Ffuzzie","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fweixian-zhang%2Ffuzzie/lists"}