Gintoki API Fuzzer

Elite differential analysis and API fuzzing tool. Establishes a baseline response per target, compares fuzzed responses for anomalies, and tests auth bypass, WAF evasion, and parameter pollution.

Features

• Differential Fuzzing – Baseline comparison with anomaly scoring (status, size, semantic similarity, error keyword detection)
• Proxy Support – Route traffic through Burp Suite, ZAP, or any HTTP proxy
• Auth Bypass Testing – Drops Authorization, Token, and Cookie headers to test unprotected endpoints
• 403/404 Bypass – Injects dummy 4KB parameter on blocked responses
• Parameter Pollution (HPP) – Duplicate keys, array notation, indexed, mixed, null-byte, case, unicode
• Rate Limit Handling – Exponential backoff (5s to 300s) on 429 responses
• Concurrent Processing – Multiple URLs via ThreadPoolExecutor
• Verbose Mode – Detailed request/response logging

Requirements

• Python 3.9+
• requests, colorama, urllib3

Installation

git clone https://github.com/afshinShh/gintoki.git
cd gintoki
pip install -r requirements.txt

Usage

usage: gintoki.py [-h] [--url URL] [--method METHOD] [--headers HEADERS]
                  [--params PARAMS] [--batch BATCH] [--payloads PAYLOADS]
                  [--concurrency CONCURRENCY] [--verbose] [--proxy PROXY]

Option	Description
--url	Target URL
--method	HTTP method (default: GET)
--headers	JSON file with headers (or omit to use examples/headers.txt key:value)
--params	JSON file with request body/query params
--batch	Batch file: URL|METHOD|HEADERS_FILE|PARAMS_FILE per line
--payloads	Payload file (default: examples/payload.txt), supports {{param}} placeholder
--concurrency	Concurrent URL workers (default: 5)
--verbose	Verbose request/response logging
--proxy	Proxy URL (e.g. http://127.0.0.1:8080)

Examples

Single URL with headers and params:

python gintoki.py --url "https://api.example.com/v1/endpoint" \
    --headers examples/headers.json --params examples/params.json

Headers can also be key:value format in examples/headers.txt (used automatically when --headers is omitted).

Batch mode:

python gintoki.py --batch examples/batch.txt --payloads examples/payload.txt

With proxy (Burp/ZAP):

python gintoki.py --url "https://api.example.com/v1/endpoint" --proxy http://127.0.0.1:8080 --verbose

Self-test:

python gintoki.py --self-test

See examples/example_usage.md for more examples.

Output

Results are written to api_fuzz_report.txt:

TIMESTAMP | URL | METHOD | TEST_TYPE | PARAMETER | PAYLOAD | STATUS | SIZE_DIFF | ANOMALY_SCORE | HOOK_TYPE

• TEST_TYPE: BASELINE, FUZZING, AUTH_BYPASS, ERROR_BYPASS, HPP, RATE_LIMIT
• ANOMALY_SCORE: 0.0–1.0 (threshold 0.4 for fuzzing, 0.5 for HPP)

Use Cases

• API security testing
• Auth and WAF bypass detection
• Parameter pollution and injection probing
• Error message and info leak detection

License

MIT License. See LICENSE for details.