Check your WAF before an attacker does

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

API Security Vulnerability Scanner designed to help you secure your APIs.

Automated API security testing

Pentest Coverage Tracker is a Burp Suite extension that helps penetration testers monitor testing coverage in real time. It logs discovered endpoints and tracks whether their parameters are actually tested in Burp Suite. This helps highlight untested attack surfaces and provides clear visibility of coverage for security teams.

Community generated list of API security tests to find OWASP top10, HackerOne top 10 vulnerabilities

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

ScriptOcalypse 🏴‍☠️- Nothing here… just a lot of weird ideas with a chaotic mix of lemonade, boredom, and automation that somehow work.

API Testing & Pentesting Inside Chrome DevTools.

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

GitHub action to run Traceable Active Security Testing in GitHub workflows

A community-driven list of custom Escape rules. Test your API security with rules that automatically adapt for you.

Bugsmirror MASST (Mobile Application Security Suite and Tools) is a comprehensive platform for end-to-end mobile application security. It offers threat detection tools for static, runtime, dynamic API testing and red teaming; robust app shielding solution for threat mitigation; threat visibility dashboard; & AI powered insight in a single platform.

High-performance API endpoint discovery tool for security professionals and bug bounty hunters.

Professional API security auditing tool that detects rate limiting vulnerabilities and misconfigurations in REST APIs

API Security Posture Assessment Platform — OWASP API Top 10 Coverage

Lightweight CLI tool for scanning REST APIs for CORS issues, methods, and info leaks.

A RESTful API brute-forcing tool in Go for ethical hacking practice. **Gobrute** is built for testing login passwords with multithreading, progress tracking, and customizable payloads, ideal for controlled environments like OWASP Juice Shop.

Multi-layer API Security Analyzer built with FastAPI + ML anomaly detection. Detects SQLi/XSS abuse, rate-limits IPs, validates payloads with Pydantic. Live dashboard + production logging. Deployable on Render.

Disclosure-safe IDOR/BOLA case study covering authorized access-control testing methodology, evidence handling, and remediation.