aeondave/restler
offensive-tools/fuzzing/restler/SKILL.md
Auth/lab ref: Stateful REST API fuzzer from OpenAPI specs. For testing complex API dependency chains, producer-consumer request sequencing, and replayable bug-bucket workflows for API reliability/security testing.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill restlerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 3:54 AM318.0s1 file scanned
SKILL.md
- name:
- restler
- description:
- Auth/lab ref: Stateful REST API fuzzer from OpenAPI specs. For testing complex API dependency chains, producer-consumer request sequencing, and replayable bug-bucket workflows for API reliability/security testing.
- license:
- MIT
- compatibility:
- Windows/Linux (64-bit primary), Python +.NET build/runtime.
- author:
- GitHub Copilot
- version:
- 1.1
restler
RESTler explores deeper API states by inferring request dependencies from OpenAPI definitions.
Workflow (Recommended Order)
- Compile: OpenAPI -> RESTler grammar.
- Test (smoke): verify setup and required dictionary values.
- Fuzz-lean: quick bug hunting baseline.
- Fuzz: deep BFS-style state exploration.
Quick Start
# Build (local)
python build-restler.py --dest_dir <restler_bin>
# Typical campaign starts with compile + test before fuzz modes
restler.exe fuzz-lean --grammar_file <grammar.py> --dictionary_file <dict.json>
restler.exe fuzz --grammar_file <grammar.py> --dictionary_file <dict.json> --time_budget 1
Operator Flow
- Validate schema quality and authentication path first.
- Run
test/smoke style workflow to confirm dependencies and dictionary values. - Run
fuzz-leanfor quick risk discovery. - Run
fuzzfor deeper sequence exploration with settings file tuning. - Reproduce via replay logs and bug buckets before assigning fixes.
Practical Notes
- Always fix setup gaps discovered in
testmode before deep fuzzing. - Deep fuzzing can cause service instability/outages on weak implementations.
- Use replay logs and bug buckets for deterministic re-validation.
High-Value Settings
fuzzing_mode(bfs,bfs-cheap,random-walk,directed-smoke-test)max_sequence_length,max_combinations- include/exclude endpoint filters (
include_requests,exclude_requests,path_regex) - retry & timing controls (
custom_retry_settings,producer_timing_delay) - trace database (
use_trace_database) for structured replay workflows
Replay & Triage Pattern
- Start from
bug_buckets.txtsummary. - Open specific bucket replay log and verify request sequence.
- Replay with same auth/host settings.
- Confirm reproducibility and collect minimal sequence evidence.
- Patch server + rerun replay to verify closure.
Common Pitfalls
- Skipping auth refresh handling leads to noisy false negatives.
- Fuzzing full API surface without scope controls can burn time-budget quickly.
- Forgetting manual cleanup after replay-created resources.
Resources
- https://github.com/microsoft/restler-fuzzer
- https://github.com/microsoft/rest-api-fuzz-testing
- https://raw.githubusercontent.com/microsoft/restler-fuzzer/main/docs/user-guide/Fuzzing.md
- https://raw.githubusercontent.com/microsoft/restler-fuzzer/main/docs/user-guide/SettingsFile.md
- https://raw.githubusercontent.com/microsoft/restler-fuzzer/main/docs/user-guide/BugBuckets.md
- https://raw.githubusercontent.com/microsoft/restler-fuzzer/main/docs/user-guide/Replay.md
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026