Rest Api Fuzz Testing Versions Save

REST API Fuzz Testing (RAFT): Source code for self-hosted service developed for Azure, including the API, orchestration engine, and default set of security tools (including MSR's RESTler), that enables developers to embed security tooling into their CI/CD workflows

v4.2

2 years ago

This release contains the following changes

  • Implement bugFound webhooks for ZAP alerts
  • Added anonymized telemetry for local runs
  • Add a verification check to ensure the CLI and service are on the same major version
  • Add certificate based authentication which can be used with RESTler (see authentication.md in docs folder)
  • Don't fail deployment if key vault already exists
  • Force service principal az login if a secret is passed on the CLI command line
  • Bypass CLI/Service capability test when deploying.

Github issues closed in this release

  • Support of certificate base authentication in RAFT for Restler #233
  • Add CLI version check with server #229

For new deployments run python raft.py service deploy. For existing deployments run python raft.py service deploy in order to upgrade the service.

v4.1.0

2 years ago

This release contains the following changes

  • Implement support for RESTler 8.0.0
    • New test mode TestAllCombinations
    • New RESTler compile setting TrackFuzzedParameterNames

Following GitHub issues are implemented in this release:

  • RESTler token settings #212
  • Fix incorrect parameter name in error message. #214
  • Set RESTler "useSSL" flag based on endpoint definition #192

For new deployments run service deploy For existing deployments run service deploy in order to upgrade the service.

v4.0.1

2 years ago
  • Expose Examples RESTler compile configuration options

If you are on v4.* RAFT, there is no action required to start using this change

v4.0

3 years ago

This release contains the following changes

  • Remove all azure dependencies from tooling and move it to dedicated container

  • Tools only need Http Get and Post to talk to Azure infrastructure

  • Move all authentication code into dedicated container

  • Move all Azure communication from tools into a dedicated container

  • Remove all authentication code from tools

  • Changes to authentication please see: authentication.md

  • Authentication type TxtToken renamed to Token
  • Remove CommandLine authentication type, since it is trivial to add custom Authentication scenarios

For new deployments run service deploy For existing deployments run service deploy in order to upgrade the service.

v3.2

3 years ago

This release contains the following changes

To the CLI

  • Added support for webhooks to the raft_local.py script
  • Auto cleanup of azure function secrets. This will prevent deployment errors
  • Fix for delay calculations when deploying test services
  • Added dateutil to requirements.txt
  • Use case-insensitive comparisons

To the Service

  • Added support for raft_local webhooks in RESTlerAgent
  • Fix a parsing error on RESTler bugs when creating postman collections

For new deployments run service deploy For existing v3.* deployments run service restart to get the service changes. Existing deployments do NOT need to run service deploy.

v3.1

3 years ago

This release contains the following changes

To the CLI

  • Updates to better support linux in raft_local python script
  • Ensure that the orchestrator is running during service deployment so that event subscription succeeds

To the Service

  • Create Postman collections for RESTler bugs
  • Update depreciated authentication API's on the frontend service
  • Fixed an IOException that sometimes occurred when running the result analyzer
  • Updated package dependencies

For new deployments run service deploy For existing v3.0 deployments run service restart to get the service changes. Existing deployments do NOT need to run service deploy.

v3.0

3 years ago

This release contains the following changes

  • Job deployments into a VNET are now supported.
  • New raft_local.py script added which allows you to run RAFT locally without Azure.
  • RESTler tasks can now be combined into a single job configuration file.
  • Secrets from the key vault are now dynamically reloaded when they change. No need to restart the service when adding or updating a secret.
  • Documentation added showing how to setup an Azure DevOps pipeline to run RAFT jobs.
  • New cli version command added to the CLI.
  • Code migrated to dotnet 5

After downloading the new CLI run python raft.py service deploy to upgrade an existing deployment or to create a new deployment.

2.3

3 years ago

Expose dredd configuration values in RAFT job definition

For 2.* deployments - after downloading the new CLI run python raft.py service update if you have an existing deployment (new deployments do this automatically for you).

v2.2

3 years ago

This release contains the following changes

  • Added tutorial on how to create a github workflow to run RAFT
  • Added retry logic to CLI when the service is temporarily unavailable
  • Fixed a deployment failure caused by an updated az CLI
  • Use the updated schemathesis image
  • Updated how-to-deploy documentation
  • Updated default scoping rules adding audience option
  • New RESTler version deployed (you will get this automatically if you are running a v2 version of RAFT)

After downloading the new CLI run python raft.py service upload-tools if you have an existing deployment (new deployments do this automatically for you).

v2.1

3 years ago

This release contains the following changes

  • Key Vault roles are no longer in preview. #123 Update to the deployment script to use the production role name.
  • Garbage collection improvements
  • Improved handling of containers with IsIdling flag
  • New tool Schemathesis has been added
  • Integrated Big-List-Of-Naughty-Strings as fuzz values used by RESTler when mutationsSeed are specified in the RESTler configuration file
  • Various documentation fixes
  • Fix in the CLI to reference command line defaults as needed. #107
  • Early work to add custom SSL encryption certificates (This only works with RESTler currently