  There are around 5.3 billion Internet users, amounting to 65.7% of the global
population, and web technology is the backbone of the services delivered via
the Internet. To ensure web applications are free from security-related bugs,
web developers test the server-side web applications before deploying them to
production. The tests are commonly conducted through the interfaces (i.e., Web
API) that the applications expose since they are the entry points to the
application. Fuzzing is one of the most promising automated software testing
techniques suitable for this task; however, the research on (server-side) web
application fuzzing has been rather limited compared to binary fuzzing which is
researched extensively. This study reviews the state-of-the-art fuzzing
frameworks for testing web applications through web API, identifies open
challenges, and gives potential future research. We collect papers from seven
online repositories of peer-reviewed articles over the last ten years. Compared
to other similar studies, our review focuses more deeply on revealing prior
work strategies in generating valid HTTP requests, utilising feedback from the
Web Under Tests (WUTs), and expanding input spaces. The findings of this survey
indicate that several crucial challenges need to be solved, such as the
ineffectiveness of web instrumentation and the complexity of handling
microservice applications. Furthermore, some potential research directions are
also provided, such as fuzzing for web client programming. Ultimately, this
paper aims to give a good starting point for developing a better web fuzzing
framework.
