cnfuzz - Cloud Native Web API Fuzzer
"Breaking Cloud Native Web APIs in their natural habitat."
Fuzzing web APIs in their fully converged Cloud Native state renders more representative results, just like it would have been deployed in production.
cnfuzz is a project written in Golang that automates fuzzing web APIs deployed in Kubernetes clusters. By tracking hashes of all container images, (re)deployed web API versions will be fuzzed - to detect potential security and stability issues and stores its results in a data lake.
OpenAPI and RESTler by Microsoft are being used to further automate the process.
Why?
- You want to fuzz web API logic where they actually operate, especially when fuzzing complete Service Meshes
- You want to integrate and/or build data lakes with fuzzing data on top of AWS S3 based storage
- You want to save expensive Cloud CI/CD pipeline credits by using idle Kubernetes cluster resources
- You want fuzzing te be done outside of your CI/CD pipeline
- You have heavy performance requirements for your fuzzing and Cloud based CI/CD pipelines do not suffice
- You want to fuzz web API's of services which are interconnected and are being deployed by different teams in the same Kubernetes cluster
- You want to automatically fuzz existing opensource software for instability issues
- You get excited over fuzzing farms
Architecture
Usage
Installation
helm repo add cnfuzz https://suecodelabs.github.io/cnfuzz
helm repo update
helm install cnfuzz cnfuzz/cnfuzz
Getting started
All it takes to getting started after installation of cnfuzz on your Kubernetes cluster is to annotate your Kubernetes Pods, Deployments, DaemonSets, etc like in the following example:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-api
spec:
selector:
matchLabels:
app: my-api
replicas: 1
template:
metadata:
labels:
app: my-api
annotations:
cnfuzz/enable: "true"
cnfuzz/open-api-doc: "/swagger/swagger.json"
cnfuzz/secret: "0d5989ed-d60c-470e-b1b5-576fcf0f5d8c"
spec:
containers:
- name: myapi
image: my-api
imagePullPolicy: Always
ports:
- containerPort: 80
Setup Kubernetes development environment
-
Install Kind and/or Rancher Desktop
-
Install Helm
Build and run
Kind
# don't forget to commit your changes locally before deploying to Kind.
make kind-init
Rancher Desktop
# don't forget to commit your changes locally before deploying to Rancher Desktop.
make rancher-init
These commands do the following:
- Setup initial deployment of
cnfuzz - Build a container image and load it into
Kubernetes - Install
cnfuzzvia helm with the local built image - Create example webapi deployment to fuzz
Kind
# don't forget to commit your changes locally before deploying to Kind.
make kind-build
Rancher Desktop
# don't forget to commit your changes locally before deploying to Kind.
make rancher-build
These commands do the following:
- (re)-build
cnfuzzand upgrade deployment with latest image
Cleanup the build
This command does the following:
- delete the
cnfuzzinstallation fromKubernetes
make k8s-clean
# If you did a git pull between the above build and the below k8s-clean
# you will see an error. Specify the release as follows:
make k8s-clean GIT_COMMIT=f4fd3d2
Build project
For building the project you can use the Makefile.
Build Docker image
IMAGE=myrepo/cnfuzz make image
Compile binary
# Compile project to binary dist/cnfuzz
make build
Prepare for release
cd docs
helm package ../charts/cnfuzz
helm repo index --url https://suecodelabs.github.io/cnfuzz/ .
Roadmap
- Opensource graduation research project
❤️ - Support Kustomize
- Integrate more tightly with Kubernetes
- Autodiscovery of possible URI prefixes
Sponsors
Engineering Team
- Luuk van den Maagdenberg, Lead Developer
- Pim Merks, Developer
- Robert Scholts, Developer
- Sylvia van Os, Developer
- Ofer Chen, Developer
- Serge van Namen, Developer / Community Lead
- Hans Strijker, Maintainer
- Sam Crauwels, Maintainer
- Michiel Westerink, Maintainer
Community
Every first Thursday of the month at 18:30 CET there will be a hybrid community meetup for users, developers and maintainers of the project hosted at Sue B.V. in the Netherlands.
Google Meet or see you at Sue B.V. including lovely drinks and food before the meetup!
Swag
Do you want swag that our awesome marketing team created for this project? Come to our community meetup on prem or contact [email protected] to receive your swag!
Stickers & Gear
Support
Do you need support that cannot be handled via issue tracking? Please contact us at [email protected] or via the contact form on this page.
19 Jan 6, 2023
125 Jan 7, 2023
3 Oct 14, 2021
6 Dec 31, 2022
0 Jan 14, 2022
451 Dec 23, 2022
22 Sep 27, 2022
3.3k Jan 8, 2023
18 Jul 2, 2021
30 Jul 22, 2022
41 Dec 30, 2022
755 Jan 6, 2023
43 Dec 25, 2022
3 Sep 24, 2021
632 Dec 23, 2022
1 Jan 4, 2022
1 Oct 9, 2021
0 Jan 7, 2022