OFFAT

OWASP OFFAT OWASP OFFAT（OFFensive Api Tester）旨在根据 OpenAPI 规范文件生成测试后，自动检测 API 的常见漏洞。它提供自动模糊测试输入的功能，并支持在测试中使用用户通过 YAML 配置文件提供的输入。 演示 注意：表中 'dataleak' 和 'result' 列代表独立的方面。端点可能存在数据泄露，但该端点的结果仍可能标记为 '成功'。这是因为 'result' 列不一定反映整体测试结果；即使存在数据泄露，它也可能显示为成功。 安全检测 受限 HTTP 方法 SQLi BOLA 数据暴露 BOPLA / 批量赋值 失效的访问控制...

Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

Predictions for 2023 from Latest API Threat Research | API Security Newsletter

March has arrived and is roaring like a very confused lion, at least in the northern hemisphere. And much like in the wild, brood production is increasing. Weve already seen some fruits of that labor, such as the Q4-2022 and 2022 Year-End ThreatStats™ Report, and some very tasty product upgrades...