Tool report: EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs

Andrea Arcuri; Man Zhang; Susruthan Seran; Juan Pablo Galeotti; Amid Golmohammadi; Onur Duman; Agustina Aldasoro; Hernan Ghianni

doi:10.1007/s10515-024-00478-1

Tool report: EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs

Andrea Arcuri^*
, Man Zhang
, Susruthan Seran
, Juan Pablo Galeotti
, Amid Golmohammadi
, Onur Duman
, Agustina Aldasoro
, Hernan Ghianni

^*此作品的通讯作者

计算机学院

Kristiania University College
Oslo Metropolitan University
Universidad de Buenos Aires

科研成果: 期刊稿件 › 文章 › 同行评审

12 引用（Scopus）

摘要

In this paper, we present the latest version 3.0.0 of EvoMaster, an open-source search-based fuzzer aimed at Web APIs. We discuss and present all its recent improvements, including advanced white-box heuristics, advanced search algorithms, support for databases and external services, as well as dealing with GraphQL and RPC APIs besides the original use case for REST APIs. The tool’s installers have been downloaded more than 3000 times. EvoMaster is in daily use for fuzzing millions of lines of code in hundreds of APIs in large Fortune 500 companies, such as for example the e-commerce Meituan.

源语言	英语
文章编号	4
期刊	Automated Software Engineering
卷	32
期	1
DOI	https://doi.org/10.1007/s10515-024-00478-1
出版状态	已出版 - 6月 2025

访问文件

10.1007/s10515-024-00478-1

其它文件与链接

链接到 Scopus 的出版物

引用此

@article{039354ad106f4b119d8fd45909250eb9,

title = "Tool report: EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs",

abstract = "In this paper, we present the latest version 3.0.0 of EvoMaster, an open-source search-based fuzzer aimed at Web APIs. We discuss and present all its recent improvements, including advanced white-box heuristics, advanced search algorithms, support for databases and external services, as well as dealing with GraphQL and RPC APIs besides the original use case for REST APIs. The tool{\textquoteright}s installers have been downloaded more than 3000 times. EvoMaster is in daily use for fuzzing millions of lines of code in hundreds of APIs in large Fortune 500 companies, such as for example the e-commerce Meituan.",

keywords = "Fuzzing, SBST, Tool, Web API",

author = "Andrea Arcuri and Man Zhang and Susruthan Seran and Galeotti, \{Juan Pablo\} and Amid Golmohammadi and Onur Duman and Agustina Aldasoro and Hernan Ghianni",

note = "Publisher Copyright: {\textcopyright} The Author(s) 2024.",

year = "2025",

month = jun,

doi = "10.1007/s10515-024-00478-1",

language = "英语",

volume = "32",

journal = "Automated Software Engineering",

issn = "0928-8910",

publisher = "Springer Netherlands",

number = "1",

}

TY - JOUR

T1 - Tool report

T2 - EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs

AU - Arcuri, Andrea

AU - Zhang, Man

AU - Seran, Susruthan

AU - Galeotti, Juan Pablo

AU - Golmohammadi, Amid

AU - Duman, Onur

AU - Aldasoro, Agustina

AU - Ghianni, Hernan

PY - 2025/6

Y1 - 2025/6

N2 - In this paper, we present the latest version 3.0.0 of EvoMaster, an open-source search-based fuzzer aimed at Web APIs. We discuss and present all its recent improvements, including advanced white-box heuristics, advanced search algorithms, support for databases and external services, as well as dealing with GraphQL and RPC APIs besides the original use case for REST APIs. The tool’s installers have been downloaded more than 3000 times. EvoMaster is in daily use for fuzzing millions of lines of code in hundreds of APIs in large Fortune 500 companies, such as for example the e-commerce Meituan.

AB - In this paper, we present the latest version 3.0.0 of EvoMaster, an open-source search-based fuzzer aimed at Web APIs. We discuss and present all its recent improvements, including advanced white-box heuristics, advanced search algorithms, support for databases and external services, as well as dealing with GraphQL and RPC APIs besides the original use case for REST APIs. The tool’s installers have been downloaded more than 3000 times. EvoMaster is in daily use for fuzzing millions of lines of code in hundreds of APIs in large Fortune 500 companies, such as for example the e-commerce Meituan.

KW - Fuzzing

KW - SBST

KW - Tool

KW - Web API

UR - https://www.scopus.com/pages/publications/85211082236

U2 - 10.1007/s10515-024-00478-1

DO - 10.1007/s10515-024-00478-1

M3 - 文章

AN - SCOPUS:85211082236

SN - 0928-8910

VL - 32

JO - Automated Software Engineering

JF - Automated Software Engineering

IS - 1

M1 - 4

ER -

Tool report: EvoMaster—black and white box search-based fuzzing for REST, GraphQL and RPC APIs

摘要

访问文件

其它文件与链接

学术指纹

引用此