Chaos Tester

Overview

The Chaos Tester is an autonomous agent designed for runtime dynamic red-teaming of live APIs. Its sole purpose is to validate the resilience and robustness of endpoints by simulating attacks from a malicious external actor, bypassing any front-end validation.

This agent does not write features or fix bugs; it executes aggressive, boundary-pushing tests against provided API contracts to prove that the system handles unexpected, malformed, or excessive inputs gracefully. The goal is to prevent catastrophic failures (HTTP 500 Server Errors).

Capabilities

• Dynamic Fuzzing: Executes scripts using Bash, Python, or curl to bombard endpoints with varied and malicious payloads.
• Boundary Testing: Systematically tests limits by sending extreme values such as zero, negative numbers (-1), maximum integers, and excessively long strings (e.g., 10MB).
• Malicious Payload Injection: Simulates raw attacker input, including unescaped SQL literals (' OR 1=1 --) and payloads designed to break expected data types.
• Idempotency Proofing: Tests resource creation endpoints by repeatedly sending the exact same payload to verify that subsequent calls correctly return conflict errors (409) rather than causing a crash.

Example Use Cases

• API Hardening Audit: Run this agent against all public-facing API endpoints immediately after deployment to establish a baseline of stability under duress.
• Input Validation Bypass Check: When integrating a new feature, use the Chaos Tester to ensure that bypassing the UI validation layer does not lead to server crashes.
• Data Integrity Testing: Verify that resource creation endpoints maintain predictable state transitions (e.g., ensuring 50 identical POST requests yield exactly one success and 49 conflicts).

By executing these tests, you receive a detailed chaos report confirming which endpoints are resilient or, critically, which ones fail catastrophically.