API attack script generation

A computer software product for identifying a vulnerability in a software application, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to input, to a large language model (LLM), a specification of an application programming interface (API) of the software application;
• to prompt the LLM to create, based on the specification, a set of artificial user identities;
• and
• to test the software application with the created user identities to discover a security vulnerability in the software application.

A method for testing a software application, comprising:

• inputting, to a large language model (LLM), a specification of an application programming interface (API) of the software application;
• prompting the LLM to identify, based on the specification, a set of API consumers that access information provided by the software application;
• for each given API consumer in the set, prompting the LLM to identify, based on the specification, one or more execution paths leading to the given consumer from respective API producers, which deliver the information to the software application;
• prompting the LLM to generate, based on the specification, respective test scripts to test the identified execution paths;
• and
• testing the software application with the generated test scripts to discover a security vulnerability in the software application.

An apparatus for testing a software application, comprising:

• a memory configured to store a large language model (LLM);
• and
• a processor configured:
• to input to the LLM, a specification of an application programming interface (API) of the software application,
• to prompt the LLM to identify, based on the specification, a set of API consumers that access information provided by the software application, for each given API consumer in the set, to prompt the LLM to identify, based on the specification, one or more execution paths leading to the given consumer from respective API producers, which deliver the information to the software application,
• to prompt the LLM to generate, based on the specification, respective test scripts to test the identified execution paths, and
• to test the software application with the generated test scripts to discover a security vulnerability in the software application.

A computer software product for identifying a vulnerability in a software application, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to input, to a large language model (LLM), a specification of an application programming interface (API) of the software application;
• to prompt the LLM to identify, based on the specification, a set of API consumers that access information provided by the software application;
• for each given API consumer in the set, to prompt the LLM to identify, based on the specification, one or more execution paths leading to the given consumer from respective API producers, which deliver the information to the software application;
• to prompt the LLM to generate, based on the specification, respective test scripts to test the identified execution paths;
• and
• to test the software application with the generated test scripts to discover a security vulnerability in the software application.