Courses
AI Automation Workflows (n8n)
General
1
Share
1
15
15
00:00
/
00:00
1x
Timecodes
0:06
What are the patterns, right?
0:08
So patterns are regular expressions which can find some vulnerabilities.
0:15
For example, remote command execution pattern.
0:20
How can we find remote command execution pattern?
0:23
So each programming language has ability to execute commands directly on the system.
0:31
So those patterns can catch those executions and say, look, this pattern is basically accepting the request from the internet and executing it.
0:49
Amazon key, AWS key, whatever key, OpenAI key.
0:54
It starts with SK after it has, you know, like whatever from A to Z symbols and the amount of those symbols are 48.
1:05
So if it starts with SK-48 symbols, this is key for charge GPT.
1:13
So this is how the patterns are working.
1:17
There are some tools, for example, SonarCube, SneakCode, Checkmarks, VeraCode, and some other ones which are doing that static analysis.
1:30
and they are mostly based on patterns.
1:32
Again, just to show you.
1:34
So the patterns are something that is matching.
1:39
The good example is OpenAI key.
1:41
It is 48 symbols.
1:44
It is starting with SK slash.
1:48
So if you find something like this, it is key.
1:52
If this is key, you know, you can after check it and all that stuff.
1:58
So there are different vulnerabilities having different patterns.
2:03
So for me, I have the project which I'm going to release to the public.
2:08
I just want to spend maybe like...
2:10
Two or three days to make sure that it is working fine.
2:17
So that project, what it can do, right?
2:22
So I just created, you know, on the Python and that
2:29
is just analyzing the source code for vulnerabilities and trying to find their patterns.
2:37
So I will show you this project.
2:43
I'm thinking to release it because I'm not seeking for any commercial interest from that.
2:49
So look at the amount of comments.
2:52
So the amount of comments is big.
2:56
So this is kind of a big project.
2:58
So what it does?
3:00
Basically, it is just analyzing the source code using patterns.
3:07
And after, it is asking AI if AI feels that this pattern matched right.
3:17
So what is the interesting part?
3:19
We can ask AI to analyze our work.
3:24
So if we did some work, right, and we feel that that work may have some mistakes, we can just use API for AI locally.
3:36
Or using like Anthropic or whatever is on the market to validate if what we are doing is right.
3:45
It can just say yes or no.
3:47
If it's no, you just remove it from the record.
3:50
So the idea here is that AI can be used not only to find vulnerabilities, but also to validate what you are providing to it.
4:00
So, yeah, something like this about this project.
4:04
I'm going to release it.
4:08
So what it will be doing?
4:10
It will be continuously scanning different random GitHub repositories.
4:17
And it will create automatically security badge.
4:24
And it will push it to the GitHub.
4:28
And it will say, look, we...
4:30
scan your repo, it has this amount of vulnerabilities.
4:34
This is your badge, fix it.
4:36
And it will go automatically to issues and it will just create the issues with all the vulnerability which we were able to find.
4:46
So the guys, you know, they will not be happy because all the GitHub
4:50
will be scanned and the issues will be created and the batch will be pushed to them as the security update.
0:06
What are the patterns, right?
0:08
So patterns are regular expressions which can find some vulnerabilities.
0:15
For example, remote command execution pattern.
0:20
How can we find remote command execution pattern?
0:23
So each programming language has ability to execute commands directly on the system.
0:31
So those patterns can catch those executions and say, look, this pattern is basically accepting the request from the internet and executing it.
0:49
Amazon key, AWS key, whatever key, OpenAI key.
0:54
It starts with SK after it has, you know, like whatever from A to Z symbols and the amount of those symbols are 48.
1:05
So if it starts with SK-48 symbols, this is key for charge GPT.
1:13
So this is how the patterns are working.
1:17
There are some tools, for example, SonarCube, SneakCode, Checkmarks, VeraCode, and some other ones which are doing that static analysis.
1:30
and they are mostly based on patterns.
1:32
Again, just to show you.
1:34
So the patterns are something that is matching.
1:39
The good example is OpenAI key.
1:41
It is 48 symbols.
1:44
It is starting with SK slash.
1:48
So if you find something like this, it is key.
1:52
If this is key, you know, you can after check it and all that stuff.
1:58
So there are different vulnerabilities having different patterns.
2:03
So for me, I have the project which I'm going to release to the public.
2:08
I just want to spend maybe like...
2:10
Two or three days to make sure that it is working fine.
2:17
So that project, what it can do, right?
2:22
So I just created, you know, on the Python and that
2:29
is just analyzing the source code for vulnerabilities and trying to find their patterns.
2:37
So I will show you this project.
2:43
I'm thinking to release it because I'm not seeking for any commercial interest from that.
2:49
So look at the amount of comments.
2:52
So the amount of comments is big.
2:56
So this is kind of a big project.
2:58
So what it does?
3:00
Basically, it is just analyzing the source code using patterns.
3:07
And after, it is asking AI if AI feels that this pattern matched right.
3:17
So what is the interesting part?
3:19
We can ask AI to analyze our work.
3:24
So if we did some work, right, and we feel that that work may have some mistakes, we can just use API for AI locally.
3:36
Or using like Anthropic or whatever is on the market to validate if what we are doing is right.
3:45
It can just say yes or no.
3:47
If it's no, you just remove it from the record.
3:50
So the idea here is that AI can be used not only to find vulnerabilities, but also to validate what you are providing to it.
4:00
So, yeah, something like this about this project.
4:04
I'm going to release it.
4:08
So what it will be doing?
4:10
It will be continuously scanning different random GitHub repositories.
4:17
And it will create automatically security badge.
4:24
And it will push it to the GitHub.
4:28
And it will say, look, we...
4:30
scan your repo, it has this amount of vulnerabilities.
4:34
This is your badge, fix it.
4:36
And it will go automatically to issues and it will just create the issues with all the vulnerability which we were able to find.
4:46
So the guys, you know, they will not be happy because all the GitHub
4:50
will be scanned and the issues will be created and the batch will be pushed to them as the security update.
📚 Lectures
📚 Lectures
Audio Version
0:00
0:00
10s
10s
1x
1
00:15
•
Study Material
Watch until the end to complete this lesson
0% watched
Back to Course