Testing large and complex enterprise software systems can be a challenging task. This is especially the case when the functionality of the system depends on interactions with other external services over a network (e.g., external web services accessed through REST API calls). Although several techniques in the research literature have been shown to be effective at generating test cases in a good number of different software testing contexts, dealing with external services is still a major research challenge. In industry, a common approach is to mock external web services for testing purposes. However, generating and configuring mock web services can be a very time-consuming task, e.g., external services may not be under the control of the same developers of the tested application, making it challenging to identify the external services and simulate various possible responses. In this article, we present a novel search-based approach aimed at fully automated mocking of external web services as part of white-box, search-based fuzzing. We rely on code instrumentation to detect all interactions with external services, and how their response data is parsed. We then use such information to enhance a search-based approach for fuzzing. The tested application is automatically modified (by manipulating DNS lookups) to rather interact with instances of mock web servers. The search process not only generates inputs to the tested applications but also automatically configures responses in those mock web server instances, aiming at maximizing code coverage and fault-finding. An empirical study on four open source REST APIs from EMB, and one industrial API from an industry partner, shows the effectiveness of our novel techniques (i.e., in terms of line coverage and fault detection).

In this paper, we present the latest version 3.0.0 of EvoMaster, an open-source search-based fuzzer aimed at Web APIs. We discuss and present all its recent improvements, including advanced white-box heuristics, advanced search algorithms, support for databases and external services, as well as dealing with GraphQL and RPC APIs besides the original use case for REST APIs. The tool's installers have been downloaded more than 3000 times. EvoMaster is in daily use for fuzzing millions of lines of code in hundreds of APIs in large Fortune 500 companies, such as for example the e-commerce Meituan.

This article presents Ph.D. research that focuses on the possibilities of adopting search-based software testing methods for microservice-based software systems to improve the software's quality and security. The research is aimed at exploring the possibilities of automatically mocking external web service dependencies of the system under test and detecting security faults through different entry points (e.g., external web services and messaging backbones) using search-based white-box fuzzing. Additionally, the article also discusses the evaluation method, the current status of the research, potential outcomes, and the contribution of the research.

Web Services like REST, GraphQL and RPC APIs are widely used in industry. They form the backends of modern Cloud Applications. In recent years, there has been an increase interest in the research community about fuzzing web services. However, there is no clear, common benchmark in the literature that can be used for comparing techniques and ease experimentation. Even if nowadays it is not so difficult to find web services on open-source repositories such as GitHub, quite a bit of work might be required to setup databases and authentication information (e.g., hashed passwords). Furthermore, how to start and stop the applications might vary greatly among the different frameworks (e.g., Spring and DropWizard) used to implement such services. For all these reasons, since 2017 we have created and maintained a corpus of web services called EMB, together with all the tooling and configurations needed to run software testing experiments. Originally, EMB was created for evaluating the fuzzer EvoMaster, but it can be (and has been) used by other tools/researchers as well. This paper discusses how EMB is designed and how its libraries can be used to run experiments on these APIs. An introductory video for EMB can be currently accessed at https://youtu.be/wJs34ATgLEw

Research in software testing often involves the development of software prototypes. Like any piece of software, there are challenges in the development, use and verification of such tools. However, some challenges are rather specific to this problem domain. For example, often these tools are developed by PhD students straight out of bachelor/master degrees, possibly lacking any industrial experience in software development. Prototype tools are used to carry out empirical studies, possibly studying different parameters of novel designed algorithms. Software scaffolding is needed to run large sets of experiments efficiently. Furthermore, when using AI-based techniques like evolutionary algorithms, care needs to be taken to deal with their randomness, which further complicates their verification. The aforementioned represent some of the challenges we have identified for this domain. In this paper, we report on our experience in building the open-source EvoMaster tool, which aims at system-level test case generation for enterprise applications. Many of the challenges we faced would be common to any researcher needing to build software testing tool prototypes. Therefore, one goal is that our shared experience here will boost the research community, by providing concrete solutions to many development challenges in the building of such kind of research prototypes. Ultimately, this will lead to increase the impact of scientific research on industrial practice.