AI Integration

[psiinon]

How could we use AI to make ZAP more effective?

• Understand the technologies behind an app better?
• Suggest more effective payloads?
• Improve false positive detection?
• Generate better reports?

This is GSoC 2024 candidate project.

Potentially interesting link: https://www.toolify.ai/ai-news/unleashing-the-power-of-ai-in-penetration-testing-1385819

Please add any more relevant links you find as comments

[psiinon]

https://www.reddit.com/r/AskNetsec/comments/1astsqu/feedback_wanted_a_saasbased_security_tool_with/

[psiinon]

https://arxiv.org/abs/2402.06664

[psiinon]

https://medium.com/@danieldkang/llm-agents-can-autonomously-hack-websites-ab33fadb3062 - from one of the authors of the above research

[vl-gx]

Recently Google relased an Open Source AI powered filetype identificator. It could be useful to better infer static filetypes: https://opensource.googleblog.com/2024/02/magika-ai-powered-fast-and-efficient-file-type-identification.html

I guess a lot of analysts do loose time with false positives.

[TmmmmmR]

One of the AI use cases I see integrating with ZAP is "API sequencing" using only the Swagger file as an input. The starting point would be a Swagger definition file, and the goal would be to generate HTTP calls that simulate real user actions. For example, let's suppose we have an API that manage products, the prompt will ask the LLM to generate API calls to simulate a real user calling these APIz through an SPA, like, first creating a product, the. viewing the product, viewing all products, searching for a product, and then deleting it, etc. This could be highly beneficial during the crawling stage of an API scan. I would be happy to work on this and mentor the future intern tasked with this integration.

[psiinon]

Thanks @TmmmmmR - thats a very good suggestion.
No one is assigned to this (and we were not accepted as a GSoC mentoring org this year) but if you fancy on working on this anyway I'd be delighted to have a call with you...