danielmiessler / danielmiessler/Fabric
[Question]: How to Use Fabric for Targeted API Security Testing Based on Logged API Details? (AI is my stranger)
- Dominant language
- Go
- Stars
- 43.9k
- Forks
- 4.3k
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 8
Description
### What is your question?
I'm currently collecting APIs from application logs, where for each API I have the following details:
- HTTP method
- URL with optional query string
- Sample request with optional body
- Sample response with body
My goal is to perform security tests to detect vulnerabilities such as: Broken Access Control (BAC), Insecure Direct Object Reference (IDOR), Rate Limiting issues, and classic injections like SQL, command, or template injection.
However, I don't want to perform all tests on every API due to the high volume of traffic it would generate. Instead, I want to:
- Plan tests for each API based on its specific details (e.g., suspicious URLs, parameter names, request bodies, or response bodies)
- Perform the tests and assess vulnerabilities by comparing the test responses with the original samples
I can write code to handle these tasks, but I'm curious if Fabric can help speed up this process. If so, could you please provide guidance on how to set this up in Fabric? Thank you for your wonderful work!
Contributor guide
Research direction
No Fabric files, tests, or entry points are mentioned; start by reviewing the project's documented workflow for applying prompts to collected API request and response data. Done would require a documented, agreed approach for selecting targeted security checks and comparing responses, but the issue does not define an implementation scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- ai, api, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100