Simple website to guess API Key / OAuth Token by Muhammad Daffa

An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers…

Go scripts for checking API key / access token validity.

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see…

Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH…

A tool used to hunt down API key leaks in JS files and pages

GraphQL - OWASP Cheat Sheet Series

PentesterLab - JSON Web Token Security Cheat Sheet

Injection - OWASP Cheat Sheet Series

Microservices - OWASP Security Cheat Sheet

42Crunch - OWASP API Security Top 10

REST Assessment - OWASP Cheat Sheet Series

REST Security - OWASP Cheat Sheet Series

The world's first conference dedicated to API threat management; bringing together breakers, defenders, and solutions…

Pre-Built Vulnerable Multiple API Scenarios Environments Based on Docker-Compose.

TryHackMe room - A Beginner level box with basic web enumeration and REST API Fuzzing.

completely ridiculous API (crAPI)

Damn Vulnerable GraphQL Application is intentionally vulnerable implementation of Facebook's GraphQL technology to…

This is a vulnerable microservice written in many languages to demonstrating OWASP API Top Security Risk (under…

Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to…

Damn Vulnerable Web Services is a vulnerable web service/API/application that we can use to learn webservices/API…

Vulnerable API with Laravel App

A simple Express.JS REST API application that exposes endpoints with code that contains vulnerabilities.

The Pixi module is a MEAN Stack web app with wildly insecure APIs!

Research on GraphQL from an AppSec point of view.

This is a "Goat" project so you can get familiar with REST API testing.

Vulnerable REST API with OWASP top 10 vulnerabilities for APIs

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios…

Intentionaly very vulnerable API with bonus bad coding practices.

A very vulnerable implementation of a GraphQL API.

Websheep is an app based on a willingly vulnerable ReSTful APIs.

This repository was developed using .NET 7.0 API technology based on findings listed in the OWASP 2019 API Security…

This Toolbox goal is to try and map out all of the different API specifications in use, as well as the services,…

gRPC vs REST: Understanding gRPC, OpenAPI and REST and when to use them in API design

API security design best practices for enterprise and public cloud.

This design guide or style guide contains best practices suitable for most REST APIs.

How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc.

A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free…

Collecting Requirements for your API with APIOps Cycles.

API Audit is a method to ensure APIs are matching the API Design guidelines. It also helps check for usability,…

Using Burp to Enumerate a REST API

Scanning APIs with ZAP

Exploring APIs with ZAP

Scan REST APIs with w3af

Open-source and next-generation Web Application Firewall (WAF) with integrated ModSecurity, OWASP Core Rule Set,…

Fast and light-weight API proxy firewall for request and response validation by OpenAPI specs.

A wordlist of API names for web application assessments

HTTP requests methods wordlist by @danielmiessler

API Routes - Automated Wordlists provided by Assetnote

Potentially dangerous files

Fuzzing APIs chapter from "The Fuzzing Book".

Wordlists and API paths by @hapi_hacker

A list of 3203 common API endpoints and objects designed for fuzzing.

The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct…

HTTP Headers: a simplified and comprehensive table.

HTTP Methods: a simplified and comprehensive table.

HTTP Status codes: a simplified and comprehensive table.

httpstatuses.com is an easy to reference database of HTTP Status Codes with their definitions and helpful code…

HTTP headers, media-types, methods, relations and status codes, all summarized and linking to their specification.

Mind map: REST API defenses

Mind map: API Pentesting - ATTACK

Organize your API security assessment by using MindAPI

Mind map: XML attacks

Mind map: GraphQL Security Testing

Mind map: IDOR Techniques

API Hacking Fundamentals, Tools, Techniques, Fails and Mindset articles.

API Security Best Practices MegaGuide

API Security, The Complete Guide

API Penetration Testing with OWASP 2017 Test Cases.

Anonymised API Penetration Testing Report - vendor sample template

Simplifying API Pentesting With Swagger Files.

Resources to help out in the API security path; diverse content from talks/webinards/videos, must read, writeups,…

Principles of API Security Testing and how to perform a Security Test on an API.

Finding and Exploiting Unintended Functionality in Main Web App APIs

How to Hack an API and Get Away with It (Part 1 of 3).

How to Hack APIs in 2021

How to Hack API in 60 minutes with Open Source Tools

How to exploit GraphQL endpoint: introspection, query, mutations & tools.

GraphQL Security Guide, Fixing the 13 most common GraphQL Vulnerabilities to make your API production ready.

My Notes on Hacking APIs from Bug Bounty Bootcamp.

SOAP Security, Top Vulnerabilities and How to Prevent Them.

What are API and microservice security?

Strengthening Your API Security Posture – Ford Motor Company.

Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion.

A video collection from Katie Paxton-Fear, @InsiderPhD, and other people creating a playlist of API hacking knowledge!

API hacking videos from @theXSSrat

The Hacker Mind Podcast: Hacking APIs

21: Troy Hunt: Hack Your API-Security Testing.

Erez Yalon — The OWASP API Security Project

We Hack Purple Podcast Episode 38 API Security Best Practices.

Pentesting Rest API's by Gaurang Bhatnagar

"How Secure are you APIs?" - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo.

API Security Testing For Hackers

Bad API, hAPI Hackers!

Hidden in Plain Site: Disclosing Information via Your APIs.

REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure.

OWASP API Security Project - API Security Top 10

A collective list of public JSON APIs for use in security.

API Blueprint Specification

AsyncAPI Specification

OpenAPI Specification

JSON API Specification

GraphQL Specification

RAML Specification

GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.

Obtain GraphQL API schema despite disabled introspection!

InQL - A Burp Extension for GraphQL Security Testing.

Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.

Security Auditor Utility for GraphQL APIs.

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.

Tool that lists the different ways of reaching a given type in a GraphQL schema.

GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration)

GraphQL threat framework used by security professionals to research security gaps in GraphQL implementations.

graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more…

Blazing fast GraphQL discovery & fingerprinting toolbox.

The missing GraphQL security security layer for Apollo GraphQL and Yoga / Envelop servers

API discovery, automated business logic testing and runtime detection

Reconstruct Open API Specifications from real-time workload traffic seamlessly.

The DevSecOps toolset for REST APIs.

APIKit：Discovery, Scan and Audit APIs Toolkit All In One.

Fuzz test your application using your OpenAPI or Swagger API definition without coding.

HTTP parameter discovery suite.

Automated Security Testing For REST API's.

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are…

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints.

Generate production ready APIs using AI based on database schema and data, optimized for AI-Agents. Supports…

Stop half-done API specifications with a CLI tool that helps you avoid undefined user behaviour by validating your API…

A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem…

Fuzzapi is a tool used for REST API pentesting anTnT-Fuzzerd uses API_Fuzzer gem.

Fast web fuzzer written in Go.

An open-source project in Golang to test different web application firewalls (WAF) for detection logic and bypasses

Contextual Content Discovery Tool.

Open-source API security tool to discover, inventory, test, and protect your APIs.

Automagically reverse-engineer REST APIs via capturing traffic

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS…

Verify the accuracy of your OpenAPI 3.x spec using real traffic and automatically apply patches that keep it up-to-date

Designed as a proof-of-concept for the feasibility of testing generic real-world REST implementations. Its goal is to…

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs…

A tool geared towards pentesting APIs using OpenAPI definitions.

OpenAPI 2.0 (Swagger) fuzzer written in python. Basically TnT for your API.

Dump all available paths and/or endpoints on WADL file.

WuppieFuzz is a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users,…

WSDL Parser extension for Burp.

WSDL Wizard is a Burp Suite plugin written in Python to detect current and discover new WSDL (Web Service Definition…

Language-agnostic HTTP API Testing Tool

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

SoapUI is a free and open-source cross-platform functional testing solution for APIs and web services.

Open-source framework for API Quality Assurance, which tests REST, GraphQL and gRPC automated and from Open API spec.

Pull out bits of URLs provided on stdin

Noir is an attack surface detector form source code.