Awesome-Mirrors/awesome-api-security
1
0
Fork 0
mirror of https://github.com/arainho/awesome-api-security.git synced 2024-10-01 01:06:11 -04:00
Code Issues Packages Projects Releases Wiki Activity
1123156741
awesome-api-security/README.md

161 lines
14 KiB
Markdown
Raw Normal View History

fix link
2020-08-14 13:39:47 -04:00
# [awesome-apisec](https://github.com/arainho/awesome-apisec)
create readme
2020-08-14 13:18:44 -04:00
**A collection of awesome API Security tools and resources.**
fix order
2021-08-04 06:48:36 -04:00
## Awesome Repositories
| Name | Description |
| ---- | ----------- |
| [awesome-security-apis](https://github.com/jaegeral/security-apis)| A collective list of public JSON APIs for use in security. |
create readme
2020-08-14 13:18:44 -04:00
## Tools
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Arjun](https://github.com/s0md3v/Arjun) | HTTP parameter discovery suite. |
| [ffuf](https://github.com/ffuf/ffuf) | Fast web fuzzer written in Go. |
new entries on topic tools - APIFuzzer, TnT-Fuzzer, GraphQLmap
2021-09-11 04:17:20 -04:00
| [fuzzapi](https://github.com/Fuzzapi/fuzzapi)| Fuzzapi is a tool used for REST API pentesting anTnT-Fuzzerd uses API_Fuzzer gem. |
| [APIFuzzer](https://github.com/KissPeter/APIFuzzer) | Fuzz test your application using your OpenAPI or Swagger API definition without coding. |
| [TnT-Fuzzer](https://github.com/Teebytes/TnT-Fuzzer) | OpenAPI 2.0 (Swagger) fuzzer written in python. Basically TnT for your API. |
| [GraphQLmap](https://github.com/swisskyrepo/GraphQLmap)| GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. |
cleanup
2021-08-04 05:42:03 -04:00
| [kiterunner](https://github.com/assetnote/kiterunner)| Contextual Content Discovery Tool. |
| [Astra](https://github.com/flipkart-incubator/Astra) | Automated Security Testing For REST API's. |
| [Automatic API Attack Tool](https://github.com/imperva/automatic-api-attack-tool) | Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output. |
| [APICheck](https://bbva.github.io/apicheck/) | The DevSecOps toolset for REST APIs. |
| [RESTler](https://github.com/microsoft/restler-fuzzer) | RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. |
| [SoapUI](https://github.com/SmartBear/soapui) | SoapUI is a free and open-source cross-platform functional testing solution for APIs and web services. |
new entry for tools topic - Swagger-EZ tool
2021-08-17 19:18:41 -04:00
| [Swagger-EZ](https://github.com/RhinoSecurityLabs/Swagger-EZ)| A tool geared towards pentesting APIs using OpenAPI definitions. |
create readme
2020-08-14 13:18:44 -04:00
new topic - Mind maps
2021-07-27 04:50:46 -04:00
## Mind maps
| Author | Name | Description |
add author to newsletter entry
2021-08-04 05:44:24 -04:00
| ------- | ---- | ----------- |
fix mindmap entry
2021-07-27 04:54:38 -04:00
| [David Sopas](https://github.com/dsopas) | [MindAPI](https://dsopas.github.io/MindAPI/play/) | Organize your API security assessment by using MindAPI |
new topic - Mind maps
2021-07-27 04:50:46 -04:00
| [Mufaddal Masalawala](https://github.com/harsh-bothra) | [IDOR Techniques](https://www.xmind.net/m/CSKSWZ/) | Mind map: IDOR Techniques |
| [Harsh Bothra](https://github.com/muffyhub) | [XML attacks](https://www.xmind.net/m/xNEY9b/) | Mind map: XML attacks |
new topic for api design, arch and dev
2021-08-04 05:24:36 -04:00
## Checklist
| Author | Name | Description |
| ------- | ---- | ------------|
cleanup
2021-08-04 05:42:03 -04:00
| Shieldfy | [API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist) | Checklist of the most important security countermeasures when designing, testing, and releasing your API. |
| Inon Shkedy | [31 days of API Security Tips](https://github.com/smodnix/31-days-of-API-Security-Tips) | This challenge is Inon Shkedy's 31 days API Security Tips. |
new topic for api design, arch and dev
2021-08-04 05:24:36 -04:00
| APIOps Cycles | [API audit checklist](https://www.apiopscycles.com/api-audit-checklist) | API Audit checklist |
| HolyBugx | [another API Security checklist](https://github.com/HolyBugx/HolyTips/blob/main/Checklist/API%20Security.pdf) | HolyTips: API security checklist
| Binary Brotherhood| [OAuth2: Security checklist](https://web.archive.org/web/20210607123429/https://www.binarybrotherhood.io/oauth2_threat_model.html)| OAuth 2.0 Threat Model Pentesting Checklist |
new topic - Mind maps
2021-07-27 04:50:46 -04:00
create readme
2020-08-14 13:18:44 -04:00
## Cheatsheets
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) | REST Security - OWASP Cheat Sheet Series |
| [REST Assessment Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Assessment_Cheat_Sheet.html) | REST Assessment - OWASP Cheat Sheet Series |
| [OWASP API Security Top 10](https://apisecurity.io/encyclopedia/content/owasp-api-security-top-10-cheat-sheet-a4.pdf) | 42Crunch - OWASP API Security Top 10 |
| [GraphQL Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html) | GraphQL - OWASP Cheat Sheet Series |
| [Microservices Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Microservices_security.html) | Microservices - OWASP Security Cheat Sheet |
| [JSON Web Token Security Cheat Sheet](https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_security_cheatsheet.pdf) | PentesterLab - JSON Web Token Security Cheat Sheet |
create readme
2020-08-14 13:18:44 -04:00
new gitbook entry HackTricks - Web API Pentesting entry
2021-06-28 06:31:34 -04:00
## Wiki's / Encyclopedias / GitBook's
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [API Security Encyclopedia](https://apisecurity.io/encyclopedia/content/api-security-encyclopedia.htm) | APIsecurity.io - API Security Encyclopedia |
| [Web API Pentesting](https://book.hacktricks.xyz/pentesting/pentesting-web/web-api-pentesting) | HackTricks - Web API Pentesting |
create readme
2020-08-14 13:18:44 -04:00
new walkthrough entry - ShipFast: Practical API security walkthrough series
2021-07-08 19:58:41 -04:00
## Training / Walkthrough / Labs
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Kontra - OWASP Top 10 for API](https://application.security/free/owasp-top-10-API) | Is a series of free interactive application security training modules that teach developers how to identify and mitigate security vulnerabilities in their web API endpoints. |
| [Pentesting Lab: vAPI](https://github.com/roottusk/vapi) | vAPI is Vulnerable Adversely Programmed Interface, Self-Hostable PHP Interface that mimics OWASP API Top 10 scenarios in the means of Exercises. |
| [ShipFast - Practical API Security Walkthrough](https://github.com/approov/shipfast-api-protection) | Learn practical Mobile and API security techniques: API Key, Static and Dynamic HMAC, Dynamic Certificate Pinning, and Mobile App Attestation. |
kontra traning modules Kontra - OWASP Top 10 for API
2021-03-06 19:23:02 -05:00
new entries for enumeration or scanning - general cleanup on table headers plus scanning/enumeration with zap/burp
2021-06-30 15:55:15 -04:00
## Enumeration / Scanning
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Burp enumeration](https://portswigger.net/support/using-burp-to-enumerate-a-rest-api) | Using Burp to Enumerate a REST API |
| [ZAP scanning](https://www.zaproxy.org/blog/2017-06-19-scanning-apis-with-zap/) | Scanning APIs with ZAP |
| [w3af scanning](http://docs.w3af.org/en/latest/scan-rest-apis.html) | Scan REST APIs with w3af |
new entries for enumeration or scanning - general cleanup on table headers plus scanning/enumeration with zap/burp
2021-06-30 15:55:15 -04:00
## Fuzzing / SecLists
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Common API endpoints](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/common-api-endpoints-mazen160.txt) | Wordlist for common API endpoints. |
| [List of API endpoints & objects](https://gist.github.com/yassineaboukir/8e12adefbd505ef704674ad6ad48743d) | A list of 3203 common API endpoints and objects designed for fuzzing. |
| [List of Swagger endpoints](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/swagger.txt) | Swagger endpoints |
| [SecLists for API's web-content discovery](https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content/api) | It is a collection of web content discovery lists for APIs used during security assessments. |
new items for fuzzing / seclists Kiterunner and API routes wordlists from Assetnote
2021-09-10 03:14:14 -04:00
| [Kiterunner Wordlists](https://github.com/assetnote/wordlists/blob/master/data/kiterunner.json) | Kiterunner Wordlists provided by Assetnote |
| [API Routes Wordlists](https://github.com/assetnote/wordlists/blob/master/data/automated.json) | API Routes - Automated Wordlists provided by Assetnote |
cleanup
2021-08-04 05:42:03 -04:00
| [GraphQL SecList](https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/graphql.txt) | It's a GraphQL list used during security assessments, collected in one place. |
new entries for enumeration or scanning - general cleanup on table headers plus scanning/enumeration with zap/burp
2021-06-30 15:55:15 -04:00
cleanup
2021-08-04 05:42:03 -04:00
## API Keys: Find & validate
new topic API Keys validation
2021-07-27 04:20:58 -04:00
| Name | Description |
cleanup
2021-08-04 05:42:03 -04:00
| ---- | ----------- |
| [Key-Checker](https://github.com/daffainfo/Key-Checker)| Go scripts for checking API key / access token validity. |
new topic API Keys validation
2021-07-27 04:20:58 -04:00
| [Keyhacks](https://github.com/streaak/keyhacks)| Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid. |
rename topic and refactoring
2021-07-27 05:09:36 -04:00
[API Key Leaks: Tools and exploits](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/API%20Key%20Leaks) | An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares.
new topic API Keys validation
2021-07-27 04:20:58 -04:00
deliberately vulnerable api's and cleanup - new topic for deliberately vulnerable API's - rename other topics
2021-06-25 05:47:12 -04:00
## Deliberately vulnerable APIs
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [crAPI](https://github.com/OWASP/crAPI) | completely ridiculous API (crAPI) |
| [VAmPI](https://github.com/erev0s/VAmPI)| Vulnerable REST API with OWASP top 10 vulnerabilities for APIs |
| [dvws-node](https://github.com/snoopysecurity/dvws-node) | Damn Vulnerable Web Service is a vulnerable web service/API/application that we can use to learn webservices/API vulnerabilities. |
| [DamnVulnerableMicroServices](https://github.com/ne0z/DamnVulnerableMicroServices) | This is a vulnerable microservice written in many languages to demonstrating OWASP API Top Security Risk (under development)|
| [Damn-Vulnerable-GraphQL-Application](https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application)| Damn Vulnerable GraphQL Application is intentionally vulnerable implementation of Facebook's GraphQL technology to learn and practice GraphQL Security. |
| [Generic-University](https://github.com/InsiderPhD/Generic-University) | Vulnerable API with Laravel App |
deliberately vulnerable api's and cleanup - new topic for deliberately vulnerable API's - rename other topics
2021-06-25 05:47:12 -04:00
api security videos
2020-08-16 16:59:16 -04:00
## Presentations / Videos
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [pentesting-rest-apis](https://www.slideshare.net/OWASPdelhi/pentesting-rest-apis-by-gaurang-bhatnagar) | Pentesting Rest API's by Gaurang Bhatnagar |
| [Securing your APIs](https://owasp.org/www-chapter-singapore/assets/presos/Securing_your_APIs_-_OWASP_API_Top_10_2019,_Real-life_Case.pdf) | "How Secure are you APIs?" - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo. |
| [api-security-testing-for-hackers](https://www.bugcrowd.com/resources/webinars/api-security-testing-for-hackers) | API Security Testing For Hackers |
| [bad-api-hapi-hackers](https://www.bugcrowd.com/resources/webinars/bad-api-hapi-hackers)| Bad API, hAPI Hackers! |
| [disclosing-information-via-your-apis](https://www.bugcrowd.com/resources/webinars/hidden-in-plain-site-disclosing-information-via-your-apis/) | Hidden in Plain Site: Disclosing Information via Your APIs. |
| [rest-in-peace-abusing-graphql](https://www.bugcrowd.com/resources/webinars/rest-in-peace-abusing-graphql-to-attack-underlying-infrastructure) | REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure. |
Arjun
2020-08-14 13:32:38 -04:00
a new topic called playlists and minor cleanup - removing single entry "API hacking for the Actually Pretty Inexperienced hacker." - adding Katie Paxton-Fear Playlist called "Everything API Hacking."
2021-07-07 05:48:40 -04:00
## Playlists
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Everything API Hacking](https://www.youtube.com/playlist?list=PLbyncTkpno5HqX1h2MnV6Qt4wvTb8Mpol) | A video collection from Katie Paxton-Fear, @InsiderPhD, and other people creating a playlist of API hacking knowledge! |
a new topic called playlists and minor cleanup - removing single entry "API hacking for the Actually Pretty Inexperienced hacker." - adding Katie Paxton-Fear Playlist called "Everything API Hacking."
2021-07-07 05:48:40 -04:00
new podcast entry Hacker Mind podcast entry called Hacking APIs
2021-06-30 15:44:46 -04:00
## Podcasts
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [Hacking APIs](https://forallsecure.com/blog/the-hacker-mind-podcast-hacking-apis) | The Hacker Mind Podcast: Hacking APIs |
| [Hack Your API-Security Testing](https://testguild.com/podcast/automation/21-troy-hunt-hack-your-api-security-testing/) | 21: Troy Hunt: Hack Your API-Security Testing. |
| [The OWASP API Security Project](https://podcast.securityjourney.com/erez-yalon-the-owasp-api-security-project/) | Erez Yalon — The OWASP API Security Project |
| [Episode 38 API Security Best Practices](https://wehackpurple.com/podcast/episode-38-api-security-best-practices/) | We Hack Purple Podcast Episode 38 API Security Best Practices. |
new podcast entry Hacker Mind podcast entry called Hacking APIs
2021-06-30 15:44:46 -04:00
add owasp api security project and fix other info
2021-05-09 06:23:01 -04:00
## Projects
cleanup
2021-08-04 05:42:03 -04:00
| Name | Description |
| ---- | ----------- |
| [owasp api security project](https://owasp.org/www-project-api-security/) | OWASP API Security Project - API Security Top 10 |
add owasp api security project and fix other info
2021-05-09 06:23:01 -04:00
fix project and newsletter menus
2021-05-14 04:13:04 -04:00
## Newsletters
add author to newsletter entry
2021-08-04 05:44:24 -04:00
| Author | Name | Description |
| ------- | ---- | ----------- |
| 42Crunch | [api security articles](https://apisecurity.io/#newsletter1) | API Security Articles - The Latest API Security News, Vulnerabilities & Best Practices. |
pentesting lab and newsletter entries
2021-05-14 04:11:47 -04:00
new topic twitter - adding apisecurity.io entry
2021-09-10 03:28:14 -04:00
## Twitter
| Author | Name | Description |
| ------- | ---- | ----------- |
| 42Crunch | [@apisecurityio](https://twitter.com/apisecurityio/) | API security news, standards, vulnerabilities, tools. |
new topic for api design, arch and dev
2021-08-04 05:24:36 -04:00
## Design / Architecture / Development
| Name | Description |
| ---- | ----------- |
cleanup
2021-08-04 05:42:03 -04:00
| [REST API Design Guide](https://www.apiopscycles.com/resources/rest-api-design-guide) | This design guide or style guide contains best practices suitable for most REST APIs. |
| [How to design a REST API](https://blog.octo.com/en/design-a-rest-api) | How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc.
| [Awesome REST](https://github.com/marmelab/awesome-rest) | A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this ongoing list.
new entry for design, arch and dev topic
2021-08-04 05:47:17 -04:00
| [Collect API Requirements](https://www.apiopscycles.com/collecting-requirements)| Collecting Requirements for your API with APIOps Cycles. |
new entry for api design, arch and dev - API Audit method
2021-08-04 05:28:49 -04:00
| [API Audit](https://www.apiopscycles.com/method/api-audit) | API Audit is a method to ensure APIs are matching the API Design guidelines. It also helps check for usability, security and API management platform compatibility. |
new topic for api design, arch and dev
2021-08-04 05:24:36 -04:00
deliberately vulnerable api's and cleanup - new topic for deliberately vulnerable API's - rename other topics
2021-06-25 05:47:12 -04:00
## Other useful resources
new entries for enumeration or scanning - general cleanup on table headers plus scanning/enumeration with zap/burp
2021-06-30 15:55:15 -04:00
Name | Description
create readme
2020-08-14 13:18:44 -04:00
---- | ----
cleanup
2021-08-04 05:42:03 -04:00
| [API Security Guide](https://www.pingidentity.com/en/company/blog/posts/2020/everything-need-know-api-security-2020.html) | API Security: The Definitive Guide |
| [API Penetration Testing](https://blog.securelayer7.net/api-penetration-testing-with-owasp-2017-test-cases) | API Penetration Testing with OWASP 2017 Test Cases. |
new entry for useful resources - API Pentesting with Swagger Files
2021-08-17 19:22:58 -04:00
| [API Pentesting with Swagger Files](https://rhinosecuritylabs.com/application-security/simplifying-api-pentesting-swagger-files/) | Simplifying API Pentesting With Swagger Files. |
cleanup
2021-08-04 05:42:03 -04:00
| [How to Hack an API and Get Away with It](https://smartbear.com/blog/test-and-monitor/api-security-testing-how-to-hack-an-api-part-1/)| API Security Testing – How to Hack an API and Get Away with It (Part 1 of 3). |
new entry or useful resources
2021-09-10 03:22:22 -04:00
| [How to Hack APIs in 2021](https://labs.detectify.com/2021/08/10/how-to-hack-apis-in-2021) | detectify - How to Hack APIs in 2021|
cleanup
2021-08-04 05:42:03 -04:00
| [GraphQL penetration testing](https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/) | How to exploit GraphQL endpoint: introspection, query, mutations & tools. |
| [SOAP Security Vulnerabilities and Prevention](https://www.neuralegion.com/blog/top-7-soap-api-vulnerabilities/) | SOAP Security: Top Vulnerabilities and How to Prevent Them. |
| [API and microservice security](https://portswigger.net/burp/vulnerability-scanner/api-security-testing/guide-to-api-microservice-security) | A guide from PortSwigger: What are API and microservice security? |
| [Strengthening Your API Security Posture](https://42crunch.com/knowledge-series/strengthening-api-security-posture/) | Strengthening Your API Security Posture – Ford Motor Company. |
| [The Fault in Our Stars](https://www.tenchisecurity.com/blog/thefaultinourstars) | Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion. |
Reference in New Issue Copy Permalink