awesome-apisec

A collection of awesome API Security tools and resources.

About • API Keys: Find and validate • Books • Cheatsheets • Checklist • Conferences •
Deliberately vulnerable APIs • Design, Architecture, Development • Encyclopedias, Projects, Wikis and GitBooks •
Enumeration, Scanning and exploration steps • Firewalls • Fuzzing, SecLists, Wordlists • HTTP 101 • Mind maps •
Newsletters • Other resources • Playlists • Podcasts • Presentations, Videos • Projects •
Security APIs • Specifications • Tools • Training, Workshops, Labs • Twitter •
• Contributions •

---

About

The awesome-api-security (aka awesome-apisec) repository is collection of awesome API Security tools and resources.
The focus goes to open-source tools and resources that benefit all the community.

Please read the contributions section before opening a pull request.

API Keys: Find and validate

Name	Description
API Guesser	Simple website to guess API Key / OAuth Token by Muhammad Daffa
API Key Leaks: Tools and exploits	An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares.
Key-Checker	Go scripts for checking API key / access token validity.
Keyhacks	Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.
Private key usage verification	Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user.

Books

Author	Publisher	Name	Description
Emily Freeman	Data Theorem Special Edition	API Security for dummies	This book is a high-level introduction to the key concepts of API security and DevSecOps.
Neil Madden	Manning	API Security in Action	API Security in Action teaches you how to create secure APIs for any situation.
Dolev Farhi and Nick Aleks	No starch press	Black Hat GraphQL	Black Hat GraphQL (book in pre-order).
Corey Ball	No starch press	Hacking APIs	Breaking Web Application Programming Interfaces.
Justing Richer and Antonio Sanso	Manning	Understanding API Security	Several chapters from several Manning books that give you some context for how API security works in the real world.

Cheatsheets

Name	Description
GraphQL Cheat Sheet	GraphQL - OWASP Cheat Sheet Series
JSON Web Token Security Cheat Sheet	PentesterLab - JSON Web Token Security Cheat Sheet
Injection Prevention Cheat Sheet	Injection - OWASP Cheat Sheet Series
Microservices Security Cheat Sheet	Microservices - OWASP Security Cheat Sheet
OWASP API Security Top 10	42Crunch - OWASP API Security Top 10
REST Assessment Cheat Sheet	REST Assessment - OWASP Cheat Sheet Series
REST Security Cheat Sheet	REST Security - OWASP Cheat Sheet Series

Checklist

Author	Name	Description
HolyBugx	another API Security checklist	HolyTips: API security checklist
APIOps Cycles	API audit checklist	API Audit checklist.
Shieldfy	API-Security-Checklist	Checklist of the most important security countermeasures when designing, testing, and releasing your API.
API Mike, @api_sec	API penetration testing checklist	Common steps to include in any API penetration testing process.
Latish Danawale	API Testing Checklist	API Testing Checklist.
Inon Shkedy	31 days of API Security Tips	This challenge is Inon Shkedy's 31 days API Security Tips.
Binary Brotherhood	OAuth2: Security checklist	OAuth 2.0 Threat Model Pentesting Checklist
Apollo	GraphQL API — GraphQL Security Checklist	9 Ways To Secure your GraphQL API — GraphQL Security Checklist
LeapGraph	GraphQL API - The Complete Vulnerability Checklist	How to Secure a GraphQL API - The Complete Vulnerability Checklist
Lokesh Gupta	REST API Security Essentials	REST API Tutorial blog entry.

Conferences

Name	Description
APIsecure	The world's first conference dedicated to API threat management; bringing together breakers, defenders, and solutions in API security.

Deliberately vulnerable APIs

Name	Author	Description
APISandbox	APISecurity Community	Pre-Built Vulnerable Multiple API Scenarios Environments Based on Docker-Compose.
Bookstore	sidchn	TryHackMe room - A Beginner level box with basic web enumeration and REST API Fuzzing.
crAPI	OWASP	completely ridiculous API (crAPI)
Damn-Vulnerable-GraphQL-Application	dolevf	Damn Vulnerable GraphQL Application is intentionally vulnerable implementation of Facebook's GraphQL technology to learn and practice GraphQL Security.
Damn Vulnerable Micro Services	ne0z	This is a vulnerable microservice written in many languages to demonstrating OWASP API Top Security Risk (under development)
Damn Vulnerable Web Services	snoopysecurity	Damn Vulnerable Web Services is a vulnerable web service/API/application that we can use to learn webservices/API vulnerabilities.
Generic-University	InsiderPhD	Vulnerable API with Laravel App
node-api-goat	layro01	A simple Express.JS REST API application that exposes endpoints with code that contains vulnerabilities.
Pixi	DevSlop	The Pixi module is a MEAN Stack web app with wildly insecure APIs!
poc-graphql	righettod	Research on GraphQL from an AppSec point of view.
REST API Goat	optiv	This is a "Goat" project so you can get familiar with REST API testing.
VAmPI	erev0s	Vulnerable REST API with OWASP top 10 vulnerabilities for APIs
vAPI	roottusk	vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
vulnapi	tkisason	Intentionaly very vulnerable API with bonus bad coding practices.
vulnerable-graphql-api	CarveSystems	A very vulnerable implementation of a GraphQL API.
Websheep	marmicode	Websheep is an app based on a willingly vulnerable ReSTful APIs.
VulnerableApp4APISecurity	Erdemstar	This repository was developed using .NET 7.0 API technology based on findings listed in the OWASP 2019 API Security Top 10.

Design, Architecture, Development

Name	Description
The API Specification Toolbox	This Toolbox goal is to try and map out all of the different API specifications in use, as well as the services, tooling, extensions, and other supporting elements.
Understanding gRPC, OpenAPI and REST	gRPC vs REST: Understanding gRPC, OpenAPI and REST and when to use them in API design
API security design best practices	API security design best practices for enterprise and public cloud.
REST API Design Guide	This design guide or style guide contains best practices suitable for most REST APIs.
How to design a REST API	How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc.
Awesome REST	A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this ongoing list.
Collect API Requirements	Collecting Requirements for your API with APIOps Cycles.
API Audit	API Audit is a method to ensure APIs are matching the API Design guidelines. It also helps check for usability, security and API management platform compatibility.

Encyclopedias, Projects, Wikis and GitBooks

Author	Name	Description
@six2dez	APIs Pentest Book	APIs Pentest Book
@csbygb	API Pentest tips	CSbyGB's Pentips
cyprosecurity	API Security Empire	The API Security Empire Project aims to present unique attack & defense methods in the API Security field
@APIsecurity.io	API Security Encyclopedia	API Security Encyclopedia
@carlospolop	Web API Pentesting	HackTricks - Web API Pentesting
@carlospolop	GraphQL	HackTricks - GraphQL

Enumeration, Scanning and exploration steps

Name	Description
Burp API enumeration	Using Burp to Enumerate a REST API
ZAP scanning	Scanning APIs with ZAP
ZAP exploring	Exploring APIs with ZAP
w3af scanning	Scan REST APIs with w3af

Firewalls

Name	Description
Wallarm Free API Firewall	Fast and light-weight API proxy firewall for request and response validation by OpenAPI specs.

Fuzzing, SecLists, Wordlists

Name	Description
API names wordlist	A wordlist of API names for web application assessments
API HTTP requests methods	HTTP requests methods wordlist by @danielmiessler
API Routes Wordlists	API Routes - Automated Wordlists provided by Assetnote
Common API endpoints	Wordlist for common API endpoints.
Filenames by fuzz.txt	Potentially dangerous files
Fuzzing APIs	Fuzzing APIs chapter from "The Fuzzing Book".
GraphQL SecList	It's a GraphQL list used during security assessments, collected in one place.
Hacking-APIs	Wordlists and API paths by @hapi_hacker
Kiterunner Wordlists	Kiterunner Wordlists provided by Assetnote
List of API endpoints & objects	A list of 3203 common API endpoints and objects designed for fuzzing.
List of Swagger endpoints	Swagger endpoints
SecLists for API's web-content discovery	It is a collection of web content discovery lists for APIs used during security assessments.

HTTP 101

Name	Description
Know your HTTP Headers!	HTTP Headers: a simplified and comprehensive table.
Know your HTTP Methods!	HTTP Methods: a simplified and comprehensive table.
Know your HTTP Status codes!	HTTP Status codes: a simplified and comprehensive table.
HTTP Status Codes	httpstatuses.com is an easy to reference database of HTTP Status Codes with their definitions and helpful code references all in one place.
Know your HTTP * Well	HTTP headers, media-types, methods, relations and status codes, all summarized and linking to their specification.

Mind maps

Author	Name	Description
Cypro AB	API Pentesting - ATTACK	Mind map: API Pentesting - ATTACK
Cypro AB	API Pentesting - Recon	Mind map: API Pentesting - Recon
Cypro AB	GraphQL Attacking	Mind map: GraphQL Attacking
Mufaddal Masalawala	IDOR Techniques	Mind map: IDOR Techniques
David Sopas	MindAPI	Organize your API security assessment by using MindAPI
Harsh Bothra	XML attacks	Mind map: XML attacks
Abhay Bhargav	REST API defenses	Mind map: REST API defenses

Newsletters

Author	Name	Description
42Crunch	api security articles	API Security Articles - The Latest API Security News, Vulnerabilities & Best Practices.
Dana Epp	api hacker’s inner circle	API Hacker’s Inner Circle Newsletter.

Other resources

Name	Author	Description
API Hacking Articles	Dana Epp	API Hacking Fundamentals, Tools, Techniques, Fails and Mindset articles.
API Security best practices guide	Expedited Security	API Security Best Practices MegaGuide
API Security: The Complete Guide	Bright Security	API Security, The Complete Guide
API Penetration Testing	SecureLayer7	API Penetration Testing with OWASP 2017 Test Cases.
API Penetration Testing Report	UnderDefense	Anonymised API Penetration Testing Report - vendor sample template
API Pentesting with Swagger Files	RhinoSecurityLabs	Simplifying API Pentesting With Swagger Files.
API security path resources	MindAPI	Resources to help out in the API security path; diverse content from talks/webinards/videos, must read, writeups, bola/idors, oauth, jwt, rate limit, ssrf and practice entries.
API Security Testing	Spherical Defence	Principles of API Security Testing and how to perform a Security Test on an API.
Finding and Exploiting Web App APIs	Bend Theory	Finding and Exploiting Unintended Functionality in Main Web App APIs
How to Hack an API and Get Away with It	SmartBear	How to Hack an API and Get Away with It (Part 1 of 3).
How to Hack APIs in 2021	Detectify	How to Hack APIs in 2021
How to Hack API in 60 minutes with Open Source Tools	Wallarm	How to Hack API in 60 minutes with Open Source Tools
GraphQL penetration testing	YesWeHAck	How to exploit GraphQL endpoint: introspection, query, mutations & tools.
Fixing the 13 most common GraphQL Vulnerabilities	WunderGraph	GraphQL Security Guide, Fixing the 13 most common GraphQL Vulnerabilities to make your API production ready.
Hacking APIs - Notes from Bug Bounty Bootcamp	Aakash Choudhary	My Notes on Hacking APIs from Bug Bounty Bootcamp.
SOAP Security Vulnerabilities and Prevention	NeuraLegion	SOAP Security, Top Vulnerabilities and How to Prevent Them.
API and microservice security	PortSwigger	What are API and microservice security?
Strengthening Your API Security Posture	42Crunch	Strengthening Your API Security Posture – Ford Motor Company.
The Fault in Our Stars	Tenchi Security	Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion.

Playlists

Name	Description
Everything API Hacking	A video collection from Katie Paxton-Fear, @InsiderPhD, and other people creating a playlist of API hacking knowledge!
API hacking	API hacking videos from @theXSSrat

Podcasts

Name	Description
Hacking APIs	The Hacker Mind Podcast: Hacking APIs
Hack Your API-Security Testing	21: Troy Hunt: Hack Your API-Security Testing.
The OWASP API Security Project	Erez Yalon — The OWASP API Security Project
Episode 38 API Security Best Practices	We Hack Purple Podcast Episode 38 API Security Best Practices.

Presentations, Videos

Name	Description
pentesting-rest-apis	Pentesting Rest API's by Gaurang Bhatnagar
Securing your APIs	"How Secure are you APIs?" - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo.
api-security-testing-for-hackers	API Security Testing For Hackers
bad-api-hapi-hackers	Bad API, hAPI Hackers!
disclosing-information-via-your-apis	Hidden in Plain Site: Disclosing Information via Your APIs.
rest-in-peace-abusing-graphql	REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure.

Projects

Name	Description
owasp api security project	OWASP API Security Project - API Security Top 10

Security APIs

Name	Description
awesome-security-apis	A collective list of public JSON APIs for use in security.

Specifications

Name	Description
API Blueprint	API Blueprint Specification
AscyncAPI	AsyncAPI Specification
OpenAPI	OpenAPI Specification
JSON API	JSON API Specification
GraphQL	GraphQL Specification
RAML	RAML Specification

Tools

Name	Description
GraphQL
BatchQL	GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.
clairvoyance	Obtain GraphQL API schema despite disabled introspection!
InQL	InQL - A Burp Extension for GraphQL Security Testing.
graphinder	Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.
graphql-cop	Security Auditor Utility for GraphQL APIs.
GraphQLmap	GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.
graphql-path-enum	Tool that lists the different ways of reaching a given type in a GraphQL schema.
graphql-playground	GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration)
graphql-threat-matrix	GraphQL threat framework used by security professionals to research security gaps in GraphQL implementations.
graphw00f	graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.
REST APIs
Akto	API discovery, automated business logic testing and runtime detection
APICheck	The DevSecOps toolset for REST APIs.
APIClarity	Reconstruct Open API Specifications from real-time workload traffic seamlessly.
APIFuzzer	Fuzz test your application using your OpenAPI or Swagger API definition without coding.
APIKit	APIKit：Discovery, Scan and Audit APIs Toolkit All In One.
Arjun	HTTP parameter discovery suite.
Astra	Automated Security Testing For REST API's.
Automatic API Attack Tool	Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
CATS	CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints.
Cherrybomb	Stop half-done API specifications with a CLI tool that helps you avoid undefined user behaviour by validating your API specifications.
ffuf	Fast web fuzzer written in Go.
fuzzapi	Fuzzapi is a tool used for REST API pentesting anTnT-Fuzzerd uses API_Fuzzer gem.
gotestwaf	An open-source project in Golang to test different web application firewalls (WAF) for detection logic and bypasses
kiterunner	Contextual Content Discovery Tool.
Metlo	Open-source API security tool to discover, inventory, test, and protect your APIs.
mitmproxy2swagger	Automagically reverse-engineer REST APIs via capturing traffic
Optic	Verify the accuracy of your OpenAPI 3.x spec using real traffic and automatically apply patches that keep it up-to-date
REST-Attacker	Designed as a proof-of-concept for the feasibility of testing generic real-world REST implementations. Its goal is to provide a framework for REST security research.
RESTler	RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
Swagger-EZ	A tool geared towards pentesting APIs using OpenAPI definitions.
TnT-Fuzzer	OpenAPI 2.0 (Swagger) fuzzer written in python. Basically TnT for your API.
wadl-dumper	Dump all available paths and/or endpoints on WADL file.
fuzz-lightyear	A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing.
SOAP
Wsdler	WSDL Parser extension for Burp.
wsdl-wizard	WSDL Wizard is a Burp Suite plugin written in Python to detect current and discover new WSDL (Web Service Definition Language) files.
Others
dredd	Language-agnostic HTTP API Testing Tool
getallurls (gau)	Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
SoapUI	SoapUI is a free and open-source cross-platform functional testing solution for APIs and web services.
Step CI	Open-source framework for API Quality Assurance, which tests REST, GraphQL and gRPC automated and from Open API spec.
unfurl	Pull out bits of URLs provided on stdin

| noir | Noir is an attack surface detector form source code. |

Training, Workshops, Labs

Author	Name	Description
Pentester Academy	API security, REST Labs	Pentester Academy - attack & defense
APIsec	API Security University	APIsec University provides training courses for application security professionals
Grant Ongers	API top 10 walkthrough	OWASP API Top 10 CTF Walk-through.
Karel Husa	BankGround API	Banking-like REST and GraphQL API for training/learning purposes.
Hacker101	GraphQL challenges	GraphQL Week on The Hacker101 Capture the Flag Challenges
OWASP-SKF	GraphQL Labs	GraphQL Labs on the OWASP Security Knowledge Framework
Corey Ball	Hacking APIs	Hacking APIs: workshop
Wesley Thijs	Let's build an API to hack	API Hacking Excercises by @TheXSSrat
Kontra	OWASP Top 10 for API	Is a series of free interactive application security training modules that teach developers how to identify and mitigate security vulnerabilities in their web API endpoints.
ShipFast	Practical API Security Walkthrough	Learn practical Mobile and API security techniques: API Key, Static and Dynamic HMAC, Dynamic Certificate Pinning, and Mobile App Attestation.

Twitter

Author	Name	Description
42Crunch	@apisecurityio	API security news, standards, vulnerabilities, tools.
Corey J. Ball	@hAPI_hacker	Cybersecurity consulting manager
Dana Epp	@ddǝɐuɐp	Microsoft Security MVP
David Sopas	@dsopas	Security Researcher
Katie Paxton-Fear	@InsiderPhD	Lecturer and hacker

Contributions

1. The purpose of this repository is to collect API Security tools and resources. The preference goes to open-source or community editions tools, creative commons resources, and resources created by the community for the benefit of the community. The exception is in the book's topic, where some referenced items may have an associated cost.

2. Other content vendor-specific, ads, commercial, restricted, free trial, freemium, closed-source (proprietary software), products or services provided in exchange for private user details are considered out of scope pull requests.

3. Content or materials not directly related to API security, hunting bugs in APIs, hardening or hacking APIs may also be discarded.

4. Duplicated content or entries that do not provide additional or relevant content compared with existing entries may also not be considered.

5. Out of scope pull requests will be probably discarded, closed or ignored without notice.

6. The twitter section reference authors of books, videos, workshops, courses, newsletters or content already existent on this repository. This is a bit subjective and may not be consensual at all! Even though it can bring division I decided to add the section since it might be useful to some of the visitors of the repository.

7. If you are an author of tools/content and your description is not accurate on twitter or other section let me know!

If you think your content fits the above purposes, please

• create a new branch
• change README.md
• push the new changes
• open a pull request

For more details check GitHub quickstart/contributing-to-projects