Awesome
awesome-apisec
<h4 align="center">A collection of awesome API Security tools and resources.</h4> <p align="center"> <a href="#about">About</a> • <a href="#api-keys-find-and-validate">API Keys: Find and validate</a> • <a href="#books">Books</a> • <a href="#cheatsheets">Cheatsheets</a> • <a href="#checklist">Checklist</a> • <a href="#conferences">Conferences</a> • </br> <a href="#deliberately-vulnerable-apis">Deliberately vulnerable APIs</a> • <a href="#design-architecture-development">Design, Architecture, Development</a> • <a href="#encyclopedias-projects-wikis-and-gitbooks">Encyclopedias, Projects, Wikis and GitBooks</a> • </br> <a href="#enumeration-scanning-and-exploration-steps">Enumeration, Scanning and exploration steps</a> • <a href="#firewalls">Firewalls</a> • <a href="#fuzzing-seclists-wordlists">Fuzzing, SecLists, Wordlists</a> • <a href="#http-101">HTTP 101</a> • <a href="#mind-maps">Mind maps</a> • </br> <a href="#newsletters">Newsletters</a> • <a href="#other-resources">Other resources</a> • <a href="#playlists">Playlists</a> • <a href="#podcasts">Podcasts</a> • <a href="#presentations-videos">Presentations, Videos</a> • <a href="#projects">Projects</a> • </br> <a href="#security-apis">Security APIs</a> • <a href="#specifications">Specifications</a> • <a href="#tools">Tools</a> • <a href="#training-workshops-labs">Training, Workshops, Labs</a> • <a href="#twitter">Twitter</a> • </br> • <a href="#contributions">Contributions</a> • </p>About
The awesome-api-security (aka awesome-apisec) repository is collection of awesome API Security tools and resources.
The focus goes to open-source tools and resources that benefit all the community.
Please read the <a href="#contributions">contributions</a> section before opening a pull request.
API Keys: Find and validate
| Name | Description |
|---|---|
| API Guesser | Simple website to guess API Key / OAuth Token by Muhammad Daffa |
| API Key Leaks: Tools and exploits | An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares. |
| Key-Checker | Go scripts for checking API key / access token validity. |
| Keyhacks | Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid. |
| Private key usage verification | Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. |
| Mantra | A tool used to hunt down API key leaks in JS files and pages |
Books
| Author | Publisher | Name | Description |
|---|---|---|---|
| Colin Domoney | Packt Publishing | Defending APIs | Focused on helping developers produce secure APIs |
| Confidence Staveley | Packt Publishing | API Security for White Hat Hackers | Uncover offensive defense strategies and get up to speed with secure API implementation |
| Corey Ball | No Starch Press | Hacking APIs | Breaking Web Application Programming Interfaces. |
| Dolev Farhi and Nick Aleks | No Starch Press | Black Hat GraphQL | Black Hat GraphQL. |
| Emily Freeman | Data Theorem Special Edition | API Security for dummies | This book is a high-level introduction to the key concepts of API security and DevSecOps. |
| Justing Richer and Antonio Sanso | Manning | Understanding API Security | Several chapters from several Manning books that give you some context for how API security works in the real world. |
| Neil Madden | Manning | API Security in Action | API Security in Action teaches you how to create secure APIs for any situation. |
Cheatsheets
| Name | Description |
|---|---|
| GraphQL Cheat Sheet | GraphQL - OWASP Cheat Sheet Series |
| JSON Web Token Security Cheat Sheet | PentesterLab - JSON Web Token Security Cheat Sheet |
| Injection Prevention Cheat Sheet | Injection - OWASP Cheat Sheet Series |
| Microservices Security Cheat Sheet | Microservices - OWASP Security Cheat Sheet |
| OWASP API Security Top 10 | 42Crunch - OWASP API Security Top 10 |
| REST Assessment Cheat Sheet | REST Assessment - OWASP Cheat Sheet Series |
| REST Security Cheat Sheet | REST Security - OWASP Cheat Sheet Series |
Checklist
| Author | Name | Description |
|---|---|---|
| HolyBugx | another API Security checklist | HolyTips: API security checklist |
| APIOps Cycles | API audit checklist | API Audit checklist. |
| Shieldfy | API-Security-Checklist | Checklist of the most important security countermeasures when designing, testing, and releasing your API. |
| API Mike, @api_sec | API penetration testing checklist | Common steps to include in any API penetration testing process. |
| Latish Danawale | API Testing Checklist | API Testing Checklist. |
| Inon Shkedy | 31 days of API Security Tips | This challenge is Inon Shkedy's 31 days API Security Tips. |
| Binary Brotherhood | OAuth2: Security checklist | OAuth 2.0 Threat Model Pentesting Checklist |
| Apollo | GraphQL API — GraphQL Security Checklist | 9 Ways To Secure your GraphQL API — GraphQL Security Checklist |
| LeapGraph | GraphQL API - The Complete Vulnerability Checklist | How to Secure a GraphQL API - The Complete Vulnerability Checklist |
| Lokesh Gupta | REST API Security Essentials | REST API Tutorial blog entry. |
Conferences
| Name | Description |
|---|---|
| APIsecure | The world's first conference dedicated to API threat management; bringing together breakers, defenders, and solutions in API security. |
Deliberately vulnerable APIs
| Name | Author | Description |
|---|---|---|
| APISandbox | APISecurity Community | Pre-Built Vulnerable Multiple API Scenarios Environments Based on Docker-Compose. |
| Bookstore | sidchn | TryHackMe room - A Beginner level box with basic web enumeration and REST API Fuzzing. |
| crAPI | OWASP | completely ridiculous API (crAPI) |
| Damn Vulnerable GraphQL Application | dolevf | Damn Vulnerable GraphQL Application is intentionally vulnerable implementation of Facebook's GraphQL technology to learn and practice GraphQL Security. |
| Damn Vulnerable Micro Services | ne0z | This is a vulnerable microservice written in many languages to demonstrating OWASP API Top Security Risk (under development). |
| Damn Vulnerable RESTaurant API Game | theowni | Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers. |
| Damn Vulnerable Web Services | snoopysecurity | Damn Vulnerable Web Services is a vulnerable web service/API/application that we can use to learn webservices/API vulnerabilities. |
| Generic-University | InsiderPhD | Vulnerable API with Laravel App |
| node-api-goat | layro01 | A simple Express.JS REST API application that exposes endpoints with code that contains vulnerabilities. |
| Pixi | DevSlop | The Pixi module is a MEAN Stack web app with wildly insecure APIs! |
| poc-graphql | righettod | Research on GraphQL from an AppSec point of view. |
| REST API Goat | optiv | This is a "Goat" project so you can get familiar with REST API testing. |
| VAmPI | erev0s | Vulnerable REST API with OWASP top 10 vulnerabilities for APIs |
| vAPI | roottusk | vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises. |
| vulnapi | tkisason | Intentionaly very vulnerable API with bonus bad coding practices. |
| vulnerable-graphql-api | CarveSystems | A very vulnerable implementation of a GraphQL API. |
| Websheep | marmicode | Websheep is an app based on a willingly vulnerable ReSTful APIs. |
| VulnerableApp4APISecurity | Erdemstar | This repository was developed using .NET 7.0 API technology based on findings listed in the OWASP 2019 API Security Top 10. |
Design, Architecture, Development
| Name | Description |
|---|---|
| The API Specification Toolbox | This Toolbox goal is to try and map out all of the different API specifications in use, as well as the services, tooling, extensions, and other supporting elements. |
| Understanding gRPC, OpenAPI and REST | gRPC vs REST: Understanding gRPC, OpenAPI and REST and when to use them in API design |
| API security design best practices | API security design best practices for enterprise and public cloud. |
| REST API Design Guide | This design guide or style guide contains best practices suitable for most REST APIs. |
| How to design a REST API | How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc. |
| Awesome REST | A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this ongoing list. |
| Collect API Requirements | Collecting Requirements for your API with APIOps Cycles. |
| API Audit | API Audit is a method to ensure APIs are matching the API Design guidelines. It also helps check for usability, security and API management platform compatibility. |
Encyclopedias, Projects, Wikis and GitBooks
| Author | Name | Description |
|---|---|---|
| @six2dez | APIs Pentest Book | APIs Pentest Book |
| @csbygb | API Pentest tips | CSbyGB's Pentips |
| cyprosecurity | API Security Empire | The API Security Empire Project aims to present unique attack & defense methods in the API Security field |
| @APIsecurity.io | API Security Encyclopedia | API Security Encyclopedia |
| @carlospolop | Web API Pentesting | HackTricks - Web API Pentesting |
| @carlospolop | GraphQL | HackTricks - GraphQL |
Enumeration, Scanning and exploration steps
| Name | Description |
|---|---|
| Burp API enumeration | Using Burp to Enumerate a REST API |
| ZAP scanning | Scanning APIs with ZAP |
| ZAP exploring | Exploring APIs with ZAP |
| w3af scanning | Scan REST APIs with w3af |
Firewalls
| Name | Description |
|---|---|
| Wallarm Free API Firewall | Fast and light-weight API proxy firewall for request and response validation by OpenAPI specs. |
Fuzzing, SecLists, Wordlists
| Name | Description |
|---|---|
| API names wordlist | A wordlist of API names for web application assessments |
| API HTTP requests methods | HTTP requests methods wordlist by @danielmiessler |
| API Routes Wordlists | API Routes - Automated Wordlists provided by Assetnote |
| Common API endpoints | Wordlist for common API endpoints. |
| Filenames by fuzz.txt | Potentially dangerous files |
| Fuzzing APIs | Fuzzing APIs chapter from "The Fuzzing Book". |
| GraphQL SecList | It's a GraphQL list used during security assessments, collected in one place. |
| Hacking-APIs | Wordlists and API paths by @hapi_hacker |
| Kiterunner Wordlists | Kiterunner Wordlists provided by Assetnote |
| List of API endpoints & objects | A list of 3203 common API endpoints and objects designed for fuzzing. |
| List of Swagger endpoints | Swagger endpoints |
| SecLists for API's web-content discovery | It is a collection of web content discovery lists for APIs used during security assessments. |
| GraphQL wordlist | The only GraphQL wordlist you'll ever need. Operations, field names, type names... Collected on more than 60k distinct GraphQL schemas. |
HTTP 101
| Name | Description |
|---|---|
| Know your HTTP Headers! | HTTP Headers: a simplified and comprehensive table. |
| Know your HTTP Methods! | HTTP Methods: a simplified and comprehensive table. |
| Know your HTTP Status codes! | HTTP Status codes: a simplified and comprehensive table. |
| HTTP Status Codes | httpstatuses.com is an easy to reference database of HTTP Status Codes with their definitions and helpful code references all in one place. |
| Know your HTTP * Well | HTTP headers, media-types, methods, relations and status codes, all summarized and linking to their specification. |
Mind maps
| Author | Name | Description |
|---|---|---|
| Abhay Bhargav | REST API defenses | Mind map: REST API defenses |
| Cypro AB | API Pentesting - ATTACK | Mind map: API Pentesting - ATTACK |
| Cypro AB | API Pentesting - Recon | Mind map: API Pentesting - Recon |
| Cypro AB | GraphQL Attacking | Mind map: GraphQL Attacking |
| David Sopas | MindAPI | Organize your API security assessment by using MindAPI |
| Harsh Bothra | XML attacks | Mind map: XML attacks |
| Mosaad Sallam) | GraphQL Security Testing | Mind map: GraphQL Security Testing |
| Mosaad Sallam) | OWASP API Top10 | Mind map: OWASP API Top 10 |
| Mufaddal Masalawala | IDOR Techniques | Mind map: IDOR Techniques |
Newsletters
| Author | Name | Description |
|---|---|---|
| 42Crunch | api security articles | API Security Articles - The Latest API Security News, Vulnerabilities & Best Practices. |
| Dana Epp | api hacker’s inner circle | API Hacker’s Inner Circle Newsletter. |
Other resources
| Name | Author | Description |
|---|---|---|
| API Hacking Articles | Dana Epp | API Hacking Fundamentals, Tools, Techniques, Fails and Mindset articles. |
| API Security best practices guide | Expedited Security | API Security Best Practices MegaGuide |
| API Security: The Complete Guide | Bright Security | API Security, The Complete Guide |
| API Penetration Testing | SecureLayer7 | API Penetration Testing with OWASP 2017 Test Cases. |
| API Penetration Testing Report | UnderDefense | Anonymised API Penetration Testing Report - vendor sample template |
| API Pentesting with Swagger Files | RhinoSecurityLabs | Simplifying API Pentesting With Swagger Files. |
| API security path resources | MindAPI | Resources to help out in the API security path; diverse content from talks/webinards/videos, must read, writeups, bola/idors, oauth, jwt, rate limit, ssrf and practice entries. |
| API Security Testing | Spherical Defence | Principles of API Security Testing and how to perform a Security Test on an API. |
| Finding and Exploiting Web App APIs | Bend Theory | Finding and Exploiting Unintended Functionality in Main Web App APIs |
| How to Hack an API and Get Away with It | SmartBear | How to Hack an API and Get Away with It (Part 1 of 3). |
| How to Hack APIs in 2021 | Detectify | How to Hack APIs in 2021 |
| How to Hack API in 60 minutes with Open Source Tools | Wallarm | How to Hack API in 60 minutes with Open Source Tools |
| GraphQL penetration testing | YesWeHAck | How to exploit GraphQL endpoint: introspection, query, mutations & tools. |
| Fixing the 13 most common GraphQL Vulnerabilities | WunderGraph | GraphQL Security Guide, Fixing the 13 most common GraphQL Vulnerabilities to make your API production ready. |
| Hacking APIs - Notes from Bug Bounty Bootcamp | Aakash Choudhary | My Notes on Hacking APIs from Bug Bounty Bootcamp. |
| SOAP Security Vulnerabilities and Prevention | NeuraLegion | SOAP Security, Top Vulnerabilities and How to Prevent Them. |
| API and microservice security | PortSwigger | What are API and microservice security? |
| Strengthening Your API Security Posture | 42Crunch | Strengthening Your API Security Posture – Ford Motor Company. |
| The Fault in Our Stars | Tenchi Security | Security Implications of AWS API Gateway Lambda Authorizers and IAM Wildcard Expansion. |
Playlists
| Name | Description |
|---|---|
| Everything API Hacking | A video collection from Katie Paxton-Fear, @InsiderPhD, and other people creating a playlist of API hacking knowledge! |
| API hacking | API hacking videos from @theXSSrat |
Podcasts
| Name | Description |
|---|---|
| Hacking APIs | The Hacker Mind Podcast: Hacking APIs |
| Hack Your API-Security Testing | 21: Troy Hunt: Hack Your API-Security Testing. |
| The OWASP API Security Project | Erez Yalon — The OWASP API Security Project |
| Episode 38 API Security Best Practices | We Hack Purple Podcast Episode 38 API Security Best Practices. |
Presentations, Videos
| Name | Description |
|---|---|
| pentesting-rest-apis | Pentesting Rest API's by Gaurang Bhatnagar |
| Securing your APIs | "How Secure are you APIs?" - Securing your APIs: OWASP API Top 10 2019, Case Study and Demo. |
| api-security-testing-for-hackers | API Security Testing For Hackers |
| bad-api-hapi-hackers | Bad API, hAPI Hackers! |
| disclosing-information-via-your-apis | Hidden in Plain Site: Disclosing Information via Your APIs. |
| rest-in-peace-abusing-graphql | REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure. |
Projects
| Name | Description |
|---|---|
| owasp api security project | OWASP API Security Project - API Security Top 10 |
Security APIs
| Name | Description |
|---|---|
| awesome-security-apis | A collective list of public JSON APIs for use in security. |
Specifications
| Name | Description |
|---|---|
| API Blueprint | API Blueprint Specification |
| AscyncAPI | AsyncAPI Specification |
| OpenAPI | OpenAPI Specification |
| JSON API | JSON API Specification |
| GraphQL | GraphQL Specification |
| RAML | RAML Specification |
Tools
| Name | Description |
|---|---|
| GraphQL | |
| BatchQL | GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. |
| clairvoyance | Obtain GraphQL API schema despite disabled introspection! |
| InQL | InQL - A Burp Extension for GraphQL Security Testing. |
| graphinder | Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. |
| graphql-cop | Security Auditor Utility for GraphQL APIs. |
| GraphQLmap | GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. |
| graphql-path-enum | Tool that lists the different ways of reaching a given type in a GraphQL schema. |
| graphql-playground | GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration) |
| graphql-threat-matrix | GraphQL threat framework used by security professionals to research security gaps in GraphQL implementations. |
| graphw00f | graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint. |
| goctopus | Blazing fast GraphQL discovery & fingerprinting toolbox. |
| graphql-armor | The missing GraphQL security security layer for Apollo GraphQL and Yoga / Envelop servers |
| REST APIs | |
| Akto | API discovery, automated business logic testing and runtime detection |
| APICheck | The DevSecOps toolset for REST APIs. |
| APIClarity | Reconstruct Open API Specifications from real-time workload traffic seamlessly. |
| APIFuzzer | Fuzz test your application using your OpenAPI or Swagger API definition without coding. |
| APIKit | APIKit：Discovery, Scan and Audit APIs Toolkit All In One. |
| Arjun | HTTP parameter discovery suite. |
| Astra | Automated Security Testing For REST API's. |
| Automatic API Attack Tool | Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output. |
| CATS | CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. |
| Cherrybomb | Stop half-done API specifications with a CLI tool that helps you avoid undefined user behaviour by validating your API specifications. |
| ffuf | Fast web fuzzer written in Go. |
| fuzzapi | Fuzzapi is a tool used for REST API pentesting anTnT-Fuzzerd uses API_Fuzzer gem. |
| gotestwaf | An open-source project in Golang to test different web application firewalls (WAF) for detection logic and bypasses |
| kiterunner | Contextual Content Discovery Tool. |
| Metlo | Open-source API security tool to discover, inventory, test, and protect your APIs. |
| mitmproxy2swagger | Automagically reverse-engineer REST APIs via capturing traffic |
| Optic | Verify the accuracy of your OpenAPI 3.x spec using real traffic and automatically apply patches that keep it up-to-date |
| OFFAT | The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion. |
| REST-Attacker | Designed as a proof-of-concept for the feasibility of testing generic real-world REST implementations. Its goal is to provide a framework for REST security research. |
| RESTler | RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. |
| Swagger-EZ | A tool geared towards pentesting APIs using OpenAPI definitions. |
| TnT-Fuzzer | OpenAPI 2.0 (Swagger) fuzzer written in python. Basically TnT for your API. |
| wadl-dumper | Dump all available paths and/or endpoints on WADL file. |
| fuzz-lightyear | A pytest-inspired, DAST framework, capable of identifying vulnerabilities in a distributed, micro-service ecosystem through chaos engineering testing and stateful, Swagger fuzzing. |
| SOAP | |
| Wsdler | WSDL Parser extension for Burp. |
| wsdl-wizard | WSDL Wizard is a Burp Suite plugin written in Python to detect current and discover new WSDL (Web Service Definition Language) files. |
| Others | |
| dredd | Language-agnostic HTTP API Testing Tool |
| getallurls (gau) | Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl. |
| SoapUI | SoapUI is a free and open-source cross-platform functional testing solution for APIs and web services. |
| Step CI | Open-source framework for API Quality Assurance, which tests REST, GraphQL and gRPC automated and from Open API spec. |
| unfurl | Pull out bits of URLs provided on stdin |
| noir | Noir is an attack surface detector form source code. |
Training, Workshops, Labs
| Author | Name | Description |
|---|---|---|
| APIsec | API Security University | APIsec University provides training courses for application security professionals |
| Corey Ball | Hacking APIs | Hacking APIs: workshop |
| Escape | API Security Academy | API Security Academy, by escape |
| Grant Ongers | API top 10 walkthrough | OWASP API Top 10 CTF Walk-through. |
| Hacker101 | GraphQL challenges | GraphQL Week on The Hacker101 Capture the Flag Challenges |
| Karel Husa | BankGround API | Banking-like REST and GraphQL API for training/learning purposes. |
| Kontra | OWASP Top 10 for API | Is a series of free interactive application security training modules that teach developers how to identify and mitigate security vulnerabilities in their web API endpoints. |
| OWASP-SKF | GraphQL Labs | GraphQL Labs on the OWASP Security Knowledge Framework |
| Pentester Academy | API security, REST Labs | Pentester Academy - attack & defense |
| Semgrep Academy | API Security Mini Course | Learn the basics of API security in this short and fun mini course! |
| ShipFast | Practical API Security Walkthrough | Learn practical Mobile and API security techniques: API Key, Static and Dynamic HMAC, Dynamic Certificate Pinning, and Mobile App Attestation. |
| Wesley Thijs | Let's build an API to hack | API Hacking Excercises by @TheXSSrat |
| Author | Name | Description |
|---|---|---|
| 42Crunch | @apisecurityio | API security news, standards, vulnerabilities, tools. |
| Corey J. Ball | @hAPI_hacker | Cybersecurity consulting manager |
| Dana Epp | @ddǝɐuɐp | Microsoft Security MVP |
| David Sopas | @dsopas | Security Researcher |
| Katie Paxton-Fear | @InsiderPhD | Lecturer and hacker |
| Wesley Thijs | @theXSSrat | Ethical hacker |
Contributions
-
Repository Purpose: This repository aims to collect API security tools and resources. Preference is given to open-source or community editions of tools, Creative Commons resources, and content created by the community for the benefit of the community.
-
Out of Scope: Pull requests that involve vendor-specific content, advertisements, commercial or restricted products, free trials, freemium services, closed-source (proprietary) software, or services that require users to provide private details will be considered out of scope and may be closed or ignored.
-
Relevance: Contributions must be directly related to API security, bug hunting, API hardening, or API hacking. Materials unrelated to these topics may be discarded.
-
Duplicates and Relevance: Duplicate entries or submissions that do not add new, relevant content beyond existing entries will not be considered.
-
Out of Scope PRs: Pull requests that fall outside the scope of this repository are likely to be discarded, closed, or ignored without notice.
-
Twitter Section: The Twitter section references authors of books, videos, workshops, courses, newsletters, or other content already present in this repository. While this section is somewhat subjective and may be divisive, it has been included as it might be helpful to some visitors of the repository.
-
Content Accuracy: If you are an author of tools or content and notice that your description is inaccurate or outdated in any section (including the Twitter section), please reach out to update it.
-
Book References: The only exception to the "out-of-scope" rule pertains to books. Some referenced books may have an associated cost, which is allowed under certain circumstances.
If you think your content fits the above purposes, please
- create a new branch
- change README.md
- push the new changes
- open a pull request
For more details check GitHub quickstart/contributing-to-projects