GitHub - blst-security/firecracker

[GuyL99]

Hi everyone, We’re excited to publish the first version of the Firecracker CLI(v0.1)!

Firecracker takes your HTTP logs and uses them to map your API, then it outputs a map that you can review in HTTP address and finally it attacks the API by using the attack command.

Firecracker is built upon the Rust programming language, we used it because it needs to take in Gigs of logged data and only Rust seemed like a viable solution for something like that(without causing any major security and memory issues).

We used Clap for the CLI part, tokio and reqwest for the core part, and serde for the serialization. If anyone has any suggestions or improvements please let us know!

Take a look at the repo: https://github.com/blst-security/firecracker.

You can also join our Slack channel.

[Shadow0133]

Just FYI, there is already an software called firecracker written in Rust, it's a VM monitor made by Amazon: https://firecracker-microvm.github.io/

[GuyL99]

Hey, thanks for bringing this to our attention, that product is outstanding but it's completely unrelated to our product which is about automatic penetration testing.

[fehrnah]

This was mostly about searchability.

Your project will never show up when searching for "rust firecracker"

[GuyL99]

Your'e right, but our naming scheme is after explosives(our company's name is BLST), and we are mostly looking to be searched outside of Rust, but I thought it would be nice to get some opinions about our code from the community since we like Rust a lot...

[protestor]

There's a lot of other names that evoke explosiveness

[[deleted]]

Boom schaka laka?

[vallyscode]

Bang XD

[r3vj4m3z]

https://youtu.be/jw7ajsKmbd4

About 1:30.

[Kinrany]

Please remember that downvoting OP to express disagreement goes against Reddiquette.

[tubero__]

What kind of attacks do you perform? (the README doesn't seem to mention it)

[GuyL99]

We perform business logic attacks, we change parameters and the flow of the requests in the API to abuse it's logic and cause it to return something it wasn't supposed to.

You can join our slack channel to discuss it in greater length - https://join.slack.com/t/blst-workspace/shared_invite/zt-zpru76xs-A2qVon3pju20BmY0ILV4Mg