api-security

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

Automatic SQL injection and database takeover tool

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.

APIKit：Discovery, Scan and Audit APIs Toolkit All In One.

This challenge is Inon Shkedy's 31 days API Security Tips.

A Collection of Notes, Checklists, Writeups on Bug Bounty Hunting and Web Application Security.

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

Metlo is an open-source API security platform.

Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.

A Huge Learning Resources with Labs For Offensive Security Players

Organize your API security assessment by using MindAPI. It's free and open for community collaboration.

Bug Bounty Tricks and useful payloads and bypasses for Web Application Security.

🔥 A curated list of awesome links related to application security related to the environments with NGINX or Kubernetes Ingres Controller (based on NGINX)

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.