Embedded
```tldr Embedded firmware fuzzing runs protocol parsers and data handlers on the host (not on-target) with AFL++ or libFuzzer providing random mutated inputs. Vulnerabilities found: buffer overflows, integer overflows, null dereferences, and infinite loops in parsing code — all without a physical device. ``` ```takeaways Fuzz the parser, not the hardware.
Security Testing
Burp Intruder automates sending many variations of a request — testing dozens of payloads against a parameter without manual repetition. It's the right tool when you know what you want to test but need to do it at scale. This guide covers authorized security testing only. Intruder is a
API Testing
RESTler is a stateful REST API fuzzer from Microsoft Research. Unlike simple fuzzers that hit each endpoint independently, RESTler infers the relationships between API calls — it knows that you must create a user before you can update it, and that updating requires the ID returned by creation. This stateful awareness
API Testing
Schemathesis and Dredd both test APIs against their OpenAPI specifications.
API Testing
Schemathesis takes your OpenAPI or GraphQL schema and automatically generates hundreds of test cases from it — including edge cases your manual test suite never thought of. It finds server crashes, unhandled exceptions, and schema violations that sit invisible in hand-written tests. This guide covers everything from basic setup to
API Testing
API fuzzing finds the bugs that escape manual testing and code review: server crashes from unexpected inputs, schema violations from edge cases, and authorization gaps revealed by unusual request sequences. But fuzzing without a clear strategy wastes time and generates noise. This guide covers the practices that make API fuzzing