Ask HN: Any Good Fuzzer for gRPC?

10 points by TheBigRoomXXL 2y ago ↗ HN

I have been using Schemathesis (https://github.com/schemathesis/schemathesis) for some time to test REST APIs and I have found it amazing. I love the ways it find unexpected bugs and it really help me have more confidence in my systems.I also love how it integrate directly with pytest but that's more of a cherry on the cake.

But now I am working with GRPC service I can't find anything similar. The few solutions I found are closed source and necessitate to integrate with 3rd party platforms.I found that strange as GRPC as RPC seem perfect for fuzzing.

Did I miss a great tool that you use?

5 comments

[ 0.20 ms ] story [ 18.5 ms ] thread

dmitry_dygalo 2y ago ↗

I am not aware of any tools like that, but eventually, I plan to add support for gRPC fuzzing to Schemathesis. There were already some discussions and it is more or less clear how to move forward. See https://github.com/schemathesis/schemathesis/discussions/190...

TheBigRoomXXL 2y ago ↗

Awesome! I looked for GRPC in the issues but didn't think to look in the discussions.

Next month my team will be dedicated to improving our testing capabilities, maybe some of that time could be dedicated to contributing GRPC capabilities ( if I am capable enough).

dmitry_dygalo 2y ago ↗

I'd be happy to help, looking forward :)

Jensson 2y ago ↗

Have you tried Googles grpc fuzzer? Not sure if the open source version is easy to use, but I used a fuzzer library when I worked at Google so they have good fuzzers themselves, but could potentially be hard to build or run or adapt to your codebase.

https://github.com/google/oss-fuzz/blob/master/projects/grpc...

TheBigRoomXXL 2y ago ↗

I remember looking at it sometimes ago and indeed it was not easy to use. Maybe it's time to try again!