# FuzzTheREST: An Intelligent Automated Black-box RESTful API Fuzzer

arXiv: https://arxiv.org/abs/2407.14361 · HTML: https://mlsanity.com/paper/2407.14361/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 27 references that are in the map.
- First posted on arXiv 19 Jul 2024.

## Builds on (most cited first, 7 of 7)

- [Automatic Web Testing using Curiosity-Driven Reinforcement Learning](https://mlsanity.com/paper/2103.06018/) (2021)
- [Magma: A Ground-Truth Fuzzing Benchmark](https://mlsanity.com/paper/2009.01120/) (2020)
- [Morest: Model-based RESTful API Testing with Execution Feedback](https://mlsanity.com/paper/2204.12148/) (2022)
- [Constrained Adversarial Learning for Automated Software Testing: a literature review](https://mlsanity.com/paper/2303.07546/) (2023)
- [QuickREST: Property-based Test Generation of OpenAPI-Described RESTful APIs](https://mlsanity.com/paper/1912.09686/) (2019)
- [Restats: A Test Coverage Tool for RESTful APIs](https://mlsanity.com/paper/2108.08209/) (2021)
- [TestLab: An Intelligent Automated Software Testing Framework](https://mlsanity.com/paper/2306.03602/) (2023)

## Built on by (most cited first, 2 of 2)

- [Agentic LLMs for REST API Test Amplification: A Comparative Study Across Cloud Applications](https://mlsanity.com/paper/2510.27417/) (2025)
- [MASTEST: A LLM-Based Multi-Agent System For RESTful API Tests](https://mlsanity.com/paper/2511.18038/) (2025)

## Abstract (arXiv)

Software's pervasive impact and increasing reliance in the era of digital transformation raise concerns about vulnerabilities, emphasizing the need for software security. Fuzzy testing is a dynamic analysis software testing technique that consists of feeding faulty input data to a System Under Test (SUT) and observing its behavior. Specifically regarding black-box RESTful API testing, recent literature has attempted to automate this technique using heuristics to perform the input search and using the HTTP response status codes for classification. However, most approaches do not keep track of code coverage, which is important to validate the solution. This work introduces a black-box RESTful API fuzzy testing tool that employs Reinforcement Learning (RL) for vulnerability detection. The fuzzer operates via the OpenAPI Specification (OAS) file and a scenarios file, which includes information to communicate with the SUT and the sequences of functionalities to test, respectively. To evaluate its effectiveness, the tool was tested on the Petstore API. The tool found a total of six unique vulnerabilities and achieved 55% code coverage.