REST API

RESTful APIs are stateless, so when a consumer authenticates to these APIs, no session is created between the client and server. Instead, the API consumer must prove their identity within every request sent to the API provider’s web server.

Swagger UI

Swagger Jacker

GitHub - BishopFox/sj: A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.GitHub

CherryBomb

GitHub - blst-security/cherrybomb: Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.GitHub

cherrybomb --file swagger.json --profile passive

Astra

Automated Security Testing For REST API's

GitHub - flipkart-incubator/Astra: Automated Security Testing For REST API'sGitHub

Automatic API Attack Tool

GitHub - imperva/automatic-api-attack-tool: Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.GitHub