danielmiessler / danielmiessler/Fabric

[Question]: How to Use Fabric for Targeted API Security Testing Based on Logged API Details? (AI is my stranger)

Open
#819 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Go
Stars
43.9k
Forks
4.3k
Avg merge
1d 4h
Merged PRs (30d)
8

Description

### What is your question?

I'm currently collecting APIs from application logs, where for each API I have the following details:

- HTTP method
- URL with optional query string
- Sample request with optional body
- Sample response with body

My goal is to perform security tests to detect vulnerabilities such as: Broken Access Control (BAC), Insecure Direct Object Reference (IDOR), Rate Limiting issues, and classic injections like SQL, command, or template injection.

However, I don't want to perform all tests on every API due to the high volume of traffic it would generate. Instead, I want to:

- Plan tests for each API based on its specific details (e.g., suspicious URLs, parameter names, request bodies, or response bodies)
- Perform the tests and assess vulnerabilities by comparing the test responses with the original samples

I can write code to handle these tasks, but I'm curious if Fabric can help speed up this process. If so, could you please provide guidance on how to set this up in Fabric? Thank you for your wonderful work!

Contributor guide

Open the contributing guide

Research direction

No Fabric files, tests, or entry points are mentioned; start by reviewing the project's documented workflow for applying prompts to collected API request and response data. Done would require a documented, agreed approach for selecting targeted security checks and comparing responses, but the issue does not define an implementation scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
ai, api, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.