JSON fuzzer that tests REST APIs and JSON endpoints for input validation vulnerabilities, schema bypass, and injection flaws.
jdam {flag-method} {flag-header} {flag-cookie} {flag-threads} {flag-proxy} {flag-timeout} {flag-data} -u {url} 📎 flag-method 📎 flag-header 📎 flag-cookie 📎 flag-threads 📎 flag-proxy 📎 flag-timeout 📎 flag-data 📎 url jdam {flag-method} {flag-header} {flag-cookie} {flag-threads} {flag-proxy} {flag-timeout} {flag-data} -u {url}Sandbox: execFile · Timeout: 300s
api.fuzz.json api.test.validation api.discovery.endpoint | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
url | string | Yes | - | Target API endpoint URL | -u, --url |
flag-method | string | No | - | HTTP method (GET, POST, PUT, PATCH) | -X, --method |
flag-data | string | No | - | Base JSON data for fuzzing | -d, --data |
flag-header | string | No | - | Custom HTTP header | -H, --header |
flag-cookie | string | No | - | HTTP Cookie header | --cookie |
flag-threads | integer | No | - | Number of threads | -t, --threads |
flag-proxy | string | No | - | HTTP proxy | -p, --proxy |
flag-timeout | integer | No | - | Request timeout in seconds | --timeout |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
api.fuzz.report | JSON fuzzing results | text/plain | - | verified |
Inputs
web.target.url Target API endpoint URL
api.schema.json JSON schema for structure-aware fuzzing
Outputs
api.fuzz.report Fuzzing results with findings
network_traffic Produces
api.fuzz.reportConsumes
web.target.urlapi.schema.json| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | medium |
| Disk I/O | low |
Basic JSON fuzzing
jdam -u https://api.example.com/endpoint -d '{"key":"value"}'POST request with multiple headers
jdam -X POST -u https://api.example.com/submit -d '{"name":"test"}' -H "Authorization: Bearer token"Fuzz through a proxy
jdam -u https://api.example.com/endpoint -p http://127.0.0.1:8080Jdam is a JSON fuzzer for testing REST APIs and JSON endpoints. It sends malformed, mutated, and edge-case JSON payloads to detect input validation issues, schema bypasses, and injection vulnerabilities in API implementations.
# Basic fuzzing
jdam -u https://api.target.com/users -d '{"id":1,"name":"test"}'
# POST method
jdam -X POST -u https://api.target.com/create -d '{"title":"test"}'
# Through proxy
jdam -u https://api.target.com/endpoint -p http://127.0.0.1:8080
# Custom auth header
jdam -u https://api.target.com/admin -d '{"role":"user"}' -H "Authorization: Bearer token"