AI Integration about zaproxy HOT 6 OPEN

One of the AI use cases I see integrating with ZAP is "API sequencing" using only the Swagger file as an input. The starting point would be a Swagger definition file, and the goal would be to generate HTTP calls that simulate real user actions. For example, let's suppose we have an API that manage products, the prompt will ask the LLM to generate API calls to simulate a real user calling these APIz through an SPA, like, first creating a product, the. viewing the product, viewing all products, searching for a product, and then deleting it, etc. This could be highly beneficial during the crawling stage of an API scan. I would be happy to work on this and mentor the future intern tasked with this integration.

from zaproxy.

https://www.reddit.com/r/AskNetsec/comments/1astsqu/feedback_wanted_a_saasbased_security_tool_with/

from zaproxy.

https://arxiv.org/abs/2402.06664

from zaproxy.

https://medium.com/@danieldkang/llm-agents-can-autonomously-hack-websites-ab33fadb3062 - from one of the authors of the above research

from zaproxy.

Recently Google relased an Open Source AI powered filetype identificator. It could be useful to better infer static filetypes: https://opensource.googleblog.com/2024/02/magika-ai-powered-fast-and-efficient-file-type-identification.html

I guess a lot of analysts do loose time with false positives.

from zaproxy.

Thanks @TmmmmmR - thats a very good suggestion.
No one is assigned to this (and we were not accepted as a GSoC mentoring org this year) but if you fancy on working on this anyway I'd be delighted to have a call with you...

from zaproxy.