Chaos

• 

  Logo

• 

  Main page

• 

  RPS and Documentation inputs

• 

  Right panel that shows results

• 

  Full panel on run complete

Inspiration

Most developers build their web apps, test them with standard, clean inputs, and call it a day. But security vulnerabilities don't happen because of clean inputs, but they happen when bad actors find exposed endpoints and spam them with intentionally malformed data to trigger crashes, data leaks, or backend failure. Writing comprehensive edge-case inputs for every single route manually takes forever. I wanted a tool that would completely automate this process and intelligently stress-test backend applications.

What it does

Chaos is an automated async API fuzzing suite designed to proactively discover edge-case vulnerabilities. Instead of blindly firing random characters, Chaos allows users to provide an API documentation link or directly upload a technical PDF specification. The system parses the layout requirements, automatically generates 5 highly targeted, mutated JSON test payloads (covering things like boundary flaws, type confusion, and input injections), and concurrently strikes the target endpoint to evaluate how gracefully it handles bad data.

How I built it

The application uses a dual-layer structure composed of a static web dashboard frontend and a Python backend running FastAPI. The entire execution flow relies heavily on asynchronous networking (async/await) to manage parallel client requests smoothly without blocking server resources.

For the intelligence core, I integrated DeepSeek v4 Flash via an external inference provider. Its massive 1 million token context window effortlessly ingests complete multi-page API specification files. I used PyPDF2 for server-side document parsing and processing, while using OpenCode to speed up rapid prototyping, route modifications, and frontend styling. The deployment is hosted containerized on Railway with strict CORS locks configured directly to my domain.

Challenges I ran into

Handling file data concurrently alongside text form inputs required configuring specific multi-part request boundaries within FastAPI's router. Another headache was dealing with global DNS propagation: testing custom routing rules across local network connections on vacation while the active server was updating links meant relying on temporary US proxy networks just to see if the container configuration was properly working.

Accomplishments that I'm proud of

Getting the asynchronous documentation parsing pipeline fully operational was a major win. Building a tool that reads complex structural documentation and dynamically turns those raw rules into real, functional exploit-mitigation tests within seconds feels awesome. Also, configuring and deploying the whole system onto a live custom domain feels great.

What I learned

I learned a ton about how to manage unstructured text inside huge AI context windows, how to handle file uploads securely via asynchronous web servers, and how the underlying layers of global DNS systems cache network properties when rolling out changes to a live web environment.

What's next for Chaos

I want to expand the tool's capabilities beyond standard POST and GET payloads to fully support complex GraphQL schema scraping and automated WebSockets fuzzing. I also want to implement automated report generation so teams can download clean PDF summaries pointing out exactly which lines of code broke under load.

Built With

• fastapi
• featherless
• html
• javascript
• openai
• pydantic
• pypdf2
• python
• urllib