Reading
An LLM-based API security testing tool that discovers business logic vulnerabilities hard to detect by traditional scanners through generating customized attack scenarios.
Section 01
Introduction: Entropy-Chaos is an LLM-based API security testing tool that solves the problem of traditional scanners' difficulty in detecting business logic vulnerabilities by generating customized attack scenarios. This article will introduce its background, core ideas, technical implementation, application scenarios, and future trends.
Section 02
Traditional API security scanning tools rely on predefined patterns and signatures, excelling at detecting known vulnerabilities like SQL injection and XSS, but are helpless against business logic vulnerabilities. Business logic vulnerabilities refer to issues that do not violate technical specifications but go against business intentions, such as: price manipulation (modifying parameters to purchase at an incorrect price), permission bypass (ordinary users accessing admin functions), race conditions (using time windows for illegal operations), and workflow bypass (skipping verification steps). These vulnerabilities require in-depth understanding of business scenarios and are blind spots for traditional scanners.
Section 03
The core idea of Entropy-Chaos is to use the reasoning and context understanding capabilities of LLMs to automatically generate customized attack scenarios for specific APIs. Reasons why LLMs are suitable for this task: 1. Context understanding: Can understand the relationship between API documents, parameters, and business scenarios; 2. Creative reasoning: Generate attack vectors that humans may not think of; 3. Adaptive learning: Dynamically adjust strategies based on API responses; 4. Natural language interface: Lower the threshold for use.
Section 04
The workflow of Entropy-Chaos is divided into four phases: 1. API analysis and understanding: Parse OpenAPI/Swagger specifications, analyze request-response structures, identify key parameters and business rules, and understand authentication and authorization mechanisms; 2. Attack vector generation: Generate scenarios such as boundary value attacks, state machine attacks, sequence attacks, and semantic attacks; 3. Dynamic test execution: Execute attack scenarios, monitor abnormal status codes, detect data leaks, verify permission controls, and record vulnerability evidence; 4. Result analysis and reporting: Filter vulnerabilities, assess severity, generate reproduction steps and repair suggestions.
Section 05
| Capability Dimension | Traditional Scanner | Entropy-Chaos |
|---|---|---|
| Known Vulnerability Detection | Excellent | Good |
| Logic Vulnerability Discovery | Limited | Excellent |
| Context Understanding | None | Strong |
| Attack Scenario Diversity | Fixed Patterns | Dynamically Generated |
| False Positive Rate | Medium | Low |
| Learning Adaptability | None | Yes |
Section 06
Entropy-Chaos is applied in multiple scenarios: 1. E-commerce platforms: Discover shopping cart price calculation vulnerabilities, coupon stacking issues, inventory deduction race conditions, and order state machine bypasses; 2. Financial systems: Identify transfer amount verification bypasses, transaction replay attacks, account privilege escalation, and audit log bypasses; 3. Enterprise SaaS: Detect tenant isolation failures, subscription tier bypasses, API quota bypasses, and data access control flaws.
Section 07
Usage and integration methods of Entropy-Chaos: 1. Standalone operation: entropy-chaos --target https://api.example.com --spec openapi.json; 2. CI/CD integration: Automatic testing on each code commit, generate reports to block high-risk deployments, track repair progress; 3. Cooperation with existing tools: First use traditional scanners to cover known vulnerabilities, then use Entropy-Chaos to uncover logic vulnerabilities, forming complete coverage.
Section 08
Technical Challenges and Solutions: 1. LLM call cost: Intelligent caching, layered strategy (lightweight model filtering), support for local open-source models; 2. Test coverage: Combine fuzz testing, mutation algorithms to generate variants, continuously learn from historical vulnerabilities; 3. Result interpretability: Generate detailed explanations, visualize attack paths, interactive review.
Future Trends: AI-driven security testing (from rule matching to intelligent reasoning), context-aware testing, adaptive attack generation, human-machine collaboration (AI generates use cases, humans verify and optimize).
Keep going with more reads from the same topic.
Splinter is a minimalist, high-performance key-value (KV) and vector storage system enabling zero-latency inter-process communication via shared memory and atomic operations. With only 766 lines of core code, it supports millions of operations per second and 768-dimensional vector storage, offering a new architectural approach for local LLM inference and data-intensive applications.
Folkering OS is the world's first AI-native bare-metal operating system, entirely written in Rust no_std without relying on Linux, POSIX, or libc. It can generate commands from scratch, compile them into WASM, and run them in 10 seconds, achieving true self-evolution.
This project explores how to use Large Language Models (LLMs) to detect logical vulnerabilities in Ethereum smart contracts, especially business logic flaws that are difficult for traditional static analysis tools to capture, such as economic manipulation and execution order errors.
This article introduces an open-source project for building modern large language models from scratch. The project evolves from a GPT-2-style basic architecture to a Llama 2/3-style production-level implementation, covering complete tutorial implementations of key technologies such as RMSNorm, RoPE, SwiGLU, GQA, and MoE.