⚡ FAST — Focused Application Security Testing

Repo-first SAST + Targeted DAST framework for finding real, exploitable execution-risk vulnerabilities fast

FAST is a community-friendly framework concept for building autonomous security testing workflows.

FAST is a high-signal application security testing framework that runs inside a repository to:

Identify app details and endpoints
Perform endpoint-driven, reachability-aware SAST
Verify exploitability before runtime testing
Prompt for a base URL, then run candidate-driven, non-destructive DAST
Produce prioritized results grouped by Unauth / Auth / Conditional / Unknown

Unlike broad scanners, FAST stays focused on the vulnerability classes most likely to lead to code execution or severe compromise.

📺 Demo Videos

(Optional section) Add demo links here when you have recordings:

🔎 Repo Inventory & Endpoint Discovery

▶️ Watch Demo
Shows FAST identifying the tech stack, discovering endpoints, and mapping authentication surfaces.

🧠 Execution-Risk SAST (Reachability + Source→Sink)

▶️ Watch Demo
Demonstrates how FAST limits analysis to reachable code paths and only flags execution-risk candidates.

🌐 Targeted DAST Correlation

▶️ Watch Demo
Shows FAST asking for a base URL and validating only the candidate paths (no blind crawling).

🌟 Features

🎯 Focused Vulnerability Scope (Execution-Risk Only)

FAST intentionally limits scope to:

Remote Code Execution (RCE)
Server-Side Request Forgery (SSRF)
XML External Entity (XXE)
Unsafe Deserialization
Remote File Inclusion (RFI)
Server-Side Template Injection (SSTI)
SQL Injection (SQLi)
Direct SQL execution functionality (e.g., admin query consoles / raw query endpoints)
Any vulnerability with a credible path to code execution

Everything else is out of scope by design.

🧩 Repo-First, Endpoint-Driven Analysis

Extracts routes/endpoints and maps them to handlers
Builds bounded reachability slices (endpoint → handler → call graph)
Scans only reachable code, reducing noise dramatically

✅ Exploitability Verification Built-In

FAST doesn’t stop at pattern matches:

Validates controllable input → sink plausibility
Detects mitigations (allowlists, parameterization, safe modes)
Scores exploitability + confidence
Produces a “needs runtime validation” shortlist

🔐 Auth-Aware Results

Findings are grouped into:

Unauth
Auth
Conditional (role/tenant/feature-flag dependent)
Unknown (insufficient evidence; never guess)

🌐 Targeted, Non-Destructive DAST

Prompts for base URL (and optional auth material)
Generates a minimal plan for candidate endpoints only
Verifies accessibility, auth gating, and observable risky behavior safely
Avoids broad crawling / “scan everything” behavior

🧾 Professional Output Artifacts

Machine-readable JSON artifacts per stage
Final report with evidence pointers and remediation guidance

🏗️ Architecture

┌──────────────────────────────────────────────────────────────┐
│                         FAST Orchestrator                     │
│               (Multi-Skill Coordination Layer)                │
└───────────────────────┬──────────────────────────────────────┘
                        │
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 1: repo_inventory                                      │
│  - App profiling (languages/frameworks/entrypoints)           │
│  - Endpoint discovery (HTTP/GraphQL/webhooks/jobs)            │
│  - Auth surface mapping (unauth/auth/conditional/unknown)     │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 2: reachability_slicing                                │
│  - Endpoint-driven reachable code slicing                     │
│  - Bounded call graph + uncertainty tracking                  │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 3: exec_risk_sast                                      │
│  - Targeted SAST on reachable slices                          │
│  - Separate detection for direct SQL execution functionality  │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 4: static_verification_and_triage                       │
│  - Exploitability & confidence scoring                        │
│  - Dedup + auth exposure grouping + pre-DAST checklist        │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
                 (User Prompt)
      Base URL + optional auth + optional sample IDs
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 5: dast_bootstrap_and_plan                              │
│  - Candidate-driven DAST plan (no broad crawling)             │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 6: targeted_dast_validation                             │
│  - Non-destructive runtime verification + evidence capture     │
└───────────────────────┬──────────────────────────────────────┘
                        ▼
┌──────────────────────────────────────────────────────────────┐
│ Skill 7: unified_reporting                                    │
│  - Correlated final report (SAST + DAST)                      │
└──────────────────────────────────────────────────────────────┘

Workflow

Repo Discovery — profile app, extract endpoints, map auth
Reachability Slicing — limit analysis to request-reachable code
Focused SAST — detect execution-risk candidates only
Static Verification — score exploitability + confidence, triage
DAST Handoff — ask for base URL (and optional auth/materials)
Targeted DAST — validate accessibility + behavior safely
Reporting — produce final grouped report

🚀 Quick Start

Prerequisites

A local repository to analyze
Python 3.8+ (if you implement helper scripts)
(Optional) security tooling for runtime validation, depending on your implementation

Install (example)

Place the FAST skills and agents into your Claude Code environment (or your own runner):

# Example layout (adjust to your system)
mkdir -p .claude/skills .claude/agents
# Copy FAST skill suite files into the above directories

Basic Usage (inside Claudecode)

Run FAST against a repo:

Run the FAST skill on this repo

FAST will:

produce repo + SAST artifacts
prompt: “Base URL?”
generate a targeted DAST plan and validate candidates

📚 Available Skills

Skill	Purpose	Outputs
`repo_inventory`	App profiling + endpoint discovery + auth mapping	`app_profile.json`, `endpoints.json`, `endpoint_auth_map.json`
`reachability_slicing`	Endpoint-driven reachable code slicing	`reachable_code_map.json`
`exec_risk_sast`	Focused SAST for execution-risk classes	`findings_sast.json`, `findings_direct_sql.json`
`static_verification_and_triage`	Exploitability scoring + grouping + pre-DAST checklist	`findings_verified.json`, triage sections
`dast_bootstrap_and_plan`	Base URL prompt + candidate-only DAST plan	`dast_plan.json`
`targeted_dast_validation`	Non-destructive runtime validation + evidence	`findings_dast.json`, runtime evidence
`unified_reporting`	Final correlated reporting	`report_final.md`

🤖 Available Agents

🔍 Repo & Inventory Agents

Agent	Purpose	Outputs
`RepoProfilerAgent`	Detects language/frameworks/entrypoints/configs	`app_profile.json`
`EndpointExtractorAgent`	Discovers endpoints and maps to handlers	`endpoints.json`
`AuthSurfaceMapperAgent`	Classifies endpoints by auth exposure	`endpoint_auth_map.json`

🧭 Reachability & SAST Agents

Agent	Purpose	Outputs
`ReachabilityAnalysisAgent`	Builds reachable code slices per endpoint	`reachable_code_map.json`
`ExecRiskCodeReviewAgent`	Finds execution-risk candidates (strict scope)	`findings_sast.json`
`DirectSQLFunctionalityDetectorAgent`	Detects “run SQL” features separately	`findings_direct_sql.json`

✅ Verification, DAST, and Reporting Agents

Agent	Purpose	Outputs
`StaticExploitabilityVerifierAgent`	Scores exploitability + confidence	`findings_verified.json`
`AccessClassificationTriageAgent`	Buckets results + pre-DAST checklist	`pre_dast_summary.json` + sections
`DASTCorrelationPlannerAgent`	Builds candidate-only DAST plan	`dast_plan.json`
`TargetedDASTValidationAgent`	Validates accessibility/behavior safely	`findings_dast.json`
`ReportingAgent`	Final correlated report	`report_final.md`

📖 Usage Examples

Example 1: Repo-First Execution-Risk Scan

Run FAST in this repository.
1) Identify the app stack and endpoints
2) Find only execution-risk issues (RCE/SSRF/XXE/deserialization/RFI/SSTI/SQLi/direct-SQL)
3) Verify exploitability statically
4) Bucket findings by unauth/auth/conditional/unknown
Then ask for a base URL to validate candidates at runtime.

Example 2: Runtime Validation After Repo Scan

Base URL: https://staging.example.com
Auth: Authorization: Bearer <token>
Sample values: { "userId": "12345" }
Validate only the candidate endpoints from the DAST plan.

📁 Directory Structure

fast/
├── .claude/
│   ├── agents/              # Agent definitions (markdown)
│   └── skills/              # Skill definitions (markdown)
└── outputs/                 # Generated artifacts
    └── <skill_name>/
        └── <project_name>/
            ├── raw/
            ├── sections/
            └── reports/

🎯 Report Format

Final Report: outputs/unified_reporting/<project>/reports/report_final.md

Report Sections:

Executive Summary (high confidence / confirmed)
Unauth Findings
Auth Findings
Conditional Findings
Unknown (needs clarification)
Appendix: endpoints inventory + methodology + evidence pointers

🔬 Testing Methodology

Why FAST is fast

FAST avoids full-repo SAST scans and blind DAST crawling by:

Extracting endpoints and slicing reachable code only
Limiting scope to execution-risk classes
Verifying exploitability before runtime testing
Running DAST only for candidate paths

False Positive Prevention

Reachability gating (endpoint-driven)
Source→sink plausibility checks
Mitigation detection (allowlists, parameterization, safe modes)
Confidence scoring + explicit “Unknown” bucket

Safe Runtime Principles

Non-destructive proof-of-behavior checks only
Rate limiting and timeouts
No arbitrary command execution attempts
Store evidence without secrets

🛠️ Configuration (Concept)

Typical config knobs:

excluded_paths (vendor/build/test)
max_depth for reachability slicing
auth_detection_rules (framework-specific)
runtime_safety_policy (timeouts, max requests, forbidden payload classes)

🤝 Contributing

Contributions are welcome:

Add a new framework route extractor

Extend EndpointExtractorAgent with a framework-specific parser
Add tests against small sample projects

Improve exploitability verification

Add better sanitizer/middleware detection
Improve call-graph slicing heuristics

Add language-specific sink catalogs

Expand source/sink definitions for Java/Node/Python/Go/.NET

📝 License

This project concept is intended to be MIT licensed (adjust as needed for your implementation).

⚠️ Legal Disclaimer

IMPORTANT: FAST is intended for authorized security testing only.

✅ Legal use: testing applications you own or are authorized to test
✅ Legal use: security research in scoped labs/CTFs/bug bounties (within scope)
❌ Illegal use: testing systems without written authorization
❌ Illegal use: exploiting vulnerabilities for malicious purposes

Users are solely responsible for compliance with laws and policies.

FAST — Focused Application Security Testing

Name		Name	Last commit message	Last commit date
Latest commit History 16 Commits
claude		claude
outputs		outputs
.gitignore		.gitignore
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation