Ask HN: Any Good Fuzzer for gRPC?

10 points by TheBigRoomXXL 2 years ago | 5 comments

I have been using Schemathesis (https://github.com/schemathesis/schemathesis) for some time to test REST APIs and I have found it amazing. I love the ways it find unexpected bugs and it really help me have more confidence in my systems.I also love how it integrate directly with pytest but that's more of a cherry on the cake.

But now I am working with GRPC service I can't find anything similar. The few solutions I found are closed source and necessitate to integrate with 3rd party platforms.I found that strange as GRPC as RPC seem perfect for fuzzing.

Did I miss a great tool that you use?

dmitry_dygalo 2 years ago |

I am not aware of any tools like that, but eventually, I plan to add support for gRPC fuzzing to Schemathesis. There were already some discussions and it is more or less clear how to move forward. See https://github.com/schemathesis/schemathesis/discussions/190...

TheBigRoomXXL 2 years ago | |

Awesome! I looked for GRPC in the issues but didn't think to look in the discussions.

Next month my team will be dedicated to improving our testing capabilities, maybe some of that time could be dedicated to contributing GRPC capabilities ( if I am capable enough).

dmitry_dygalo 2 years ago | | |

I'd be happy to help, looking forward :)

Jensson 2 years ago |

Have you tried Googles grpc fuzzer? Not sure if the open source version is easy to use, but I used a fuzzer library when I worked at Google so they have good fuzzers themselves, but could potentially be hard to build or run or adapt to your codebase.

https://github.com/google/oss-fuzz/blob/master/projects/grpc...

TheBigRoomXXL 2 years ago | |

I remember looking at it sometimes ago and indeed it was not easy to use. Maybe it's time to try again!