awesome-apisec

A collection of awesome API Security tools and resources.

Awesome Repositories

Repository	Description
awesome-security-apis	A collective list of public JSON APIs for use in security

Tools

Repository	Description
Arjun	HTTP parameter discovery suite
fuzzapi	Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem
kiterunner	Contextual Content Discovery Tool
MindAPI	Organize your API security assessment by using MindAPI
Astra	Automated Security Testing For REST API's

Cheatsheets

Website	Description
REST Security Cheat Sheet	REST Security - OWASP Cheat Sheet Series
OWASP API Security Top 10	42Crunch - OWASP API Security Top 10
GraphQL Cheat Sheet	GraphQL - OWASP Cheat Sheet Series

Wiki's / Encyclopedias

Website	Description
API Security Encyclopedia	APIsecurity.io - API Security Encyclopedia

Checklist

Repository	Description
API-Security-Checklist	Checklist of the most important security countermeasures when designing, testing, and releasing your API

Training / Labs

Website	Description
Kontra - OWASP Top 10 for API	Is a series of free interactive application security training modules that teach developers how to identify and mitigate security vulnerabilities in their web API endpoints.
Pentesting Lab: vAPI	vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable PHP Interface that mimics OWASP API Top 10 scenarios in the means of Exercises.

Deliberately vulnerable APIs

Website	Description
crAPI	completely ridiculous API (crAPI)
VAmPI	Vulnerable REST API with OWASP top 10 vulnerabilities for APIs
dvws-node	Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities.
DamnVulnerableMicroServices	This is vulnerable microservice written in many language to demonstrating OWASP API Top Security Risk (under development)
Damn-Vulnerable-GraphQL-Application	Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

Presentations / Videos

Website	Description
API hacking for Inexperienced hacker	API hacking for the Actually Pretty Inexperienced hacker with Katie Paxton-Fear - OWASP DevSlop
pentesting-rest-apis	Pentesting Rest API's by :- Gaurang Bhatnagar
Securing your APIs	“How Secure are you APIs?” - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo
api-security-testing-for-hackers	API Security Testing For Hackers
bad-api-hapi-hackers	Bad API, hAPI Hackers!
disclosing-information-via-your-apis	Hidden in Plain Site: Disclosing Information via Your APIs
rest-in-peace-abusing-graphql	REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure

Projects

Project	Description
owasp api security project	OWASP API Security Project - API Security Top 10

Newsletters

Newsletter	Description
api security articles	API Security Articles - The Latest API Security News, Vulnerabilities & Best Practices

Fuzzing / SecLists

Location	Description
List of API endpoints & objects	A list of 3203 common API endpoints and objects designed for fuzzing.
SecLists for API's web-content discovery	It is a collection of web content discovery lists for APIs used during security assessments.
GraphQL SecList	It's a GraphQL list used during security assessments, collected in one place.

Other useful resources

Website	Description
31-days-of-API-Security-Tips	This challenge is Inon Shkedy's 31 days API Security Tips.
Awesome REST	A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this on-going list.
How to design a REST API	How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc.
API Penetration Testing	API Penetration Testing with OWASP 2017 Test Cases
api-security-testing-how-to-hack	API Security Testing – How to Hack an API and Get Away with It (Part 1 of 3)
GraphQL penetration testing	How to exploit GraphQL endpoint: introspection, query, mutations & tools