VAmPI

VAmPI The Vulnerable API Based on OpenAPI 3 VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes...

OFFAT

OWASP OFFAT OWASP OFFAT OFFensive Api Tester is created to automatically test API for common vulnerabilities after generating tests from openapi specification file. It provides feature to automatically fuzz inputs and use user provided inputs during tests specified via YAML config file. Demo Note...

BurpAPISecuritySuite

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. BurpAPISecuritySuite...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

metlo

Metlo API Security 保护您的API。 Metlo 是一个开源的API安全平台 Metlo 是一个开源API安全工具，您可以在15分钟内完成部署，它能够盘点您的端点、检测恶意行为，并实时拦截恶意流量。 实时检测API攻击。 自动拦截恶意行为者。 创建所有API端点和敏感数据的清单。 在API投入生产前主动进行安全测试。 免费开始使用！ 如果您想部署我们的开源产品，我们提供了面向 AWS、GCP、Azure 和 Docker 的部署说明。 功能特性 端点发现 - Metlo 扫描网络流量，为您API中的每一个端点建立清单。 敏感数据扫描 -...

Download Monitor <= 4.7.60 - Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)

OneNav v0.9.35-20240318 is vulnerable to server-side request forgery SSRF via the url parameter in the getlinkinfo API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-33832 info: name: OneNav v0.9.35-20240318 - Server-Side Reque...

api-scanner-docker

API Scanner - Self-Hosted Deployment API Scanner is an automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specifications and WSDL files. Prerequisites Docker Engine 20.10+ Docker Compose v2 Python 3.6+ for setup script 8 GB RAM minimum 16 G...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

crAPI

crAPI c ompletely r idiculous API crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. crAPI is modern, built on top of a microservices architecture. When time has come to buy your...

gotestwaf

GoTestWAF GoTestWAF 是一个用于 API 和 OWASP 攻击模拟的工具，支持多种 API 协议，包括 REST、GraphQL、gRPC、SOAP、XMLRPC 以及其他。 它旨在评估 Web 应用程序安全解决方案，例如 API 安全代理、Web 应用防火墙、IPS、API 网关以及其他。 工作原理 要求 Docker 快速开始 检查评估结果 演示 其他运行 GoTestWAF 的选项 配置选项 与 OWASP 核心规则集回归测试套件一起运行 工作原理 GoTestWAF 使用编码后的负载生成恶意请求，这些负载放置在 HTTP 请求的不同部分：请求体、请求头、URL...

openapi_security_scanner

OpenAPI Security Scanner About The Project Authorization security issues in modern web applications could not be easily picked up by security scanners. A few examples from Shopify, LINE, NordVPN. One of the reasons is that the security scanners mainly looking for SQLi, XSS, RCE instead of looking...

akto

Akto.io API 安全 贡献者 什么是 Akto？ 工作原理 • 快速开始 • API 资产清单 • API 测试 • 添加测试 • 加入 Discord 社区 • Akto 是一个即时、开源的 API 安全平台，只需 60 秒即可上手。安全团队使用 Akto 持续维护 API 资产清单、测试 API 漏洞并发现运行时问题。Akto 覆盖了所有 OWASP Top 10 和 HackerOne Top 10 类别，包括 BOLA、身份验证、SSRF、XSS、安全配置等。Akto 强大的测试引擎通过读取流量数据来理解 API 流量模式，从而运行各种业务逻辑测试，减少误报。Akto...

API-Security

OWASP API Security Top 10 This project is designed to address the ever-increasing number of organizations that are deploying potentially sensitive APIs as part of their software offerings. These APIs are used for internal tasks and to interface with third parties. Unfortunately, many APIs do not...

PENTEST-LAB

PENTEST-LAB A modern vulnerable application & cyber range for learning web, API, cloud, AI, and blue-team security through hands-on attack chains. root@kitploit: ╔═══════════════════════════════════════════════════════════════╗ ║ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗ ║ ║...

cherrybomb

cherrybombv1.0.png Stop half-done API specifications 💣 What is Cherrybomb? Cherrybomb is an CLI tool written in Rust that helps prevent incorrect code implementation early in development. It works by validating and testing your API using an OpenAPI file. Its main goal is to reduce security errors...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

apidetector

APIDetector 是一款强大且高效的工具，专为测试各个子域名中暴露的 Swagger 端点而设计，具有独特的智能能力来检测误报。对于从事 API 测试和漏洞扫描的安全专业人员和开发者尤其有用。 已在 BlackHat Arsenal 2024 上展示（链接） 版本历史 版本 3 新增功能（当前版本） 现代化 Web 界面 ：用户友好的界面，便于进行 API 端点扫描 实时结果 ：实时更新发现的端点和漏洞 交互式仪表盘 ：使用 Tailwind CSS 和 Alpine.js 构建的简洁且响应式的用户界面 文件上传支持 ：通过上传文本文件一次性扫描多个域名/子域名 域名验证...

OpenHunterAI

OpenHunterAI Tu equipo rojo de IA local. Razonamiento estilo atacante para la seguridad de aplicaciones web, API y LLM. Inicio rápido · Habilidad de agente · Modelo de evaluación · Arquitectura · Documentación · Historial de estrellas...

API-Security-Checklist

English | 简中版 | العربية | Azərbaycan | Български | বাংলা | Català | Čeština | Deutsch | Ελληνικά | Español | فارسی | Français | हिंदी | Indonesia | Italiano | 日本語 | 한국어 | ພາສາລາວ | Македонски | മലയാളം | Монгол | Nederlands | Polski | Português Brasil | Русский | ไทย | Türkçe | Українська | Tiếng...