mirror of
https://github.com/arainho/awesome-api-security.git
synced 2024-10-01 01:06:11 -04:00
7.1 KiB
7.1 KiB
awesome-apisec
A collection of awesome API Security tools and resources.
Awesome Repositories
| Repository | Description |
|---|---|
| awesome-security-apis | A collective list of public JSON APIs for use in security |
Tools
| Repository | Description |
|---|---|
| Arjun | HTTP parameter discovery suite |
| fuzzapi | Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem |
| kiterunner | Contextual Content Discovery Tool |
| MindAPI | Organize your API security assessment by using MindAPI |
| Astra | Automated Security Testing For REST API's |
| Automatic API Attack Tool | Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output. |
Cheatsheets
| Website | Description |
|---|---|
| REST Security Cheat Sheet | REST Security - OWASP Cheat Sheet Series |
| OWASP API Security Top 10 | 42Crunch - OWASP API Security Top 10 |
| GraphQL Cheat Sheet | GraphQL - OWASP Cheat Sheet Series |
Wiki's / Encyclopedias / GitBook's
| Website | Description |
|---|---|
| API Security Encyclopedia | APIsecurity.io - API Security Encyclopedia |
| Web API Pentesting | HackTricks - Web API Pentesting |
Checklist
| Repository | Description |
|---|---|
| API-Security-Checklist | Checklist of the most important security countermeasures when designing, testing, and releasing your API |
Training / Labs
| Website | Description |
|---|---|
| Kontra - OWASP Top 10 for API | Is a series of free interactive application security training modules that teach developers how to identify and mitigate security vulnerabilities in their web API endpoints. |
| Pentesting Lab: vAPI | vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable PHP Interface that mimics OWASP API Top 10 scenarios in the means of Exercises. |
Deliberately vulnerable APIs
| Website | Description |
|---|---|
| crAPI | completely ridiculous API (crAPI) |
| VAmPI | Vulnerable REST API with OWASP top 10 vulnerabilities for APIs |
| dvws-node | Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities. |
| DamnVulnerableMicroServices | This is vulnerable microservice written in many language to demonstrating OWASP API Top Security Risk (under development) |
| Damn-Vulnerable-GraphQL-Application | Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. |
Presentations / Videos
| Website | Description |
|---|---|
| API hacking for Inexperienced hacker | API hacking for the Actually Pretty Inexperienced hacker with Katie Paxton-Fear - OWASP DevSlop |
| pentesting-rest-apis | Pentesting Rest API's by :- Gaurang Bhatnagar |
| Securing your APIs | “How Secure are you APIs?” - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo |
| api-security-testing-for-hackers | API Security Testing For Hackers |
| bad-api-hapi-hackers | Bad API, hAPI Hackers! |
| disclosing-information-via-your-apis | Hidden in Plain Site: Disclosing Information via Your APIs |
| rest-in-peace-abusing-graphql | REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure |
Podcasts
| Website | Description |
|---|---|
| Podcast: Hacking APIs | The Hacker Mind Podcast: Hacking APIs |
Projects
| Project | Description |
|---|---|
| owasp api security project | OWASP API Security Project - API Security Top 10 |
Newsletters
| Newsletter | Description |
|---|---|
| api security articles | API Security Articles - The Latest API Security News, Vulnerabilities & Best Practices |
Fuzzing / SecLists
| Location | Description |
|---|---|
| List of API endpoints & objects | A list of 3203 common API endpoints and objects designed for fuzzing. |
| SecLists for API's web-content discovery | It is a collection of web content discovery lists for APIs used during security assessments. |
| GraphQL SecList | It's a GraphQL list used during security assessments, collected in one place. |
Other useful resources
| Website | Description |
|---|---|
| 31-days-of-API-Security-Tips | This challenge is Inon Shkedy's 31 days API Security Tips. |
| Awesome REST | A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this on-going list. |
| How to design a REST API | How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc. |
| API Penetration Testing | API Penetration Testing with OWASP 2017 Test Cases |
| api-security-testing-how-to-hack | API Security Testing – How to Hack an API and Get Away with It (Part 1 of 3) |
| GraphQL penetration testing | How to exploit GraphQL endpoint: introspection, query, mutations & tools |