Tools & Scanners

GitHub - fatihtuzunn/api-pentesting-tool: Node.js-based API penetration testing tool with a user-friendly web interface.GitHub

OWASP OFFAT

GitHub - OWASP/OFFAT: The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.GitHub

SOAPi

GitHub - andrei8055/SOAPI: SOAPI - The OpenAPI Documentation ScannerGitHub

Online

Sign Up

API Vulnerability Scanner | Online API security testing toolPentest-Tools.com

Burp Scan

Running API-only scansBurp_Suite

SoapUI

The World’s Most Popular API Testing Tool | SoapUI

An Introduction to API Testing with SoapUI

WSDL

Use Of SoapUICSharp.com

Send request to Burp

https://bug-rider.medium.com/soapui-configuration-with-burpsuite-b082dadec5dcbug-rider.medium.com

Postman

Postman Usage

Install and update Postman | Postman Learning CenterPostman Learning Center

On DevTools, Network, right click on a API request, "Copy as cURL".

Once you have copied the desired request, open Postman. Select Import and click on the "Raw text" tab. Paste in the cURL request and select import.

API Burp Extension

5 more Burp extensions for API hackingDana Epp's Blog

API Guesser

API Guesser

VulnAPI

GitHub - cerberauth/vulnapi: API Security Vulnerability Scanner designed to help you secure your APIs.GitHub

AKTO

GitHub - akto-api-security/akto: Proactive, Open source API security → API discovery, Testing in CI/CD, Test Library with 150+ Tests, Add custom tests, Sensitive data exposureGitHub

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• Hacking APIs: Breaking Web Application Programming Interfaces A crash course in web API security testing that will prepare you to penetration-test APIs, reap high rewards on bug bounty programs, and make your own APIs more secure.
• Black Hat GraphQL: Attacking Next Generation APIs This hands-on book teaches penetration testers how to identify vulnerabilities in apps that use GraphQL, a data query and manipulation language for APIs adopted by major companies like Facebook and GitHub.