#1Tools for assessing the security of REST, SOAP, and GraphQL APIs.
Kitploit recommended
asaotomo/hx0-hawkeye一个轻量级浏览器抓包与安全分析扩展，在浏览器侧边栏中即可完成抓包、拦截、修改、重放、规则检测与AI辅助分析的完整工作流。（A lightweight browser extension for traffic capture and security analysis, enabling…
sech0us3/waf-checkerAutomated WAF assessment tool that detects firewall vendors, tests 19 attack categories with advanced evasion payloads, and provides color-coded…
xaaha/hulakA lightweight, file-based CLI API client with age-encrypted secrets, first-class GraphQL support, and a built-in MCP server for AI agent workflows.
nccgroup/argumentinjectionhammerA Burp Extension designed to identify argument injection vulnerabilities.
google/aura-inspectorAutomated security testing tool for Salesforce Experience Cloud that discovers misconfigured Aura applications, accessible records, and unauthorized…
epi052/feroxfuzzBuild structure-aware black-box HTTP fuzzers in Rust with composable mutators, schedulers, observers, deciders, and processors for custom web and API…
manuelberrueta/flowanalyzerFlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).
pentestgeek/burpcommanderRuby command-line interface to Burp Suite's REST API
cybervelia/graphicatorAutomated GraphQL schema enumeration and data extraction tool that iterates introspection documents, reconstructs queries, and saves responses for…
mda2av/http11probeAn open testing platform that probes HTTP/1.1 servers against RFC 9110/9112 requirements, smuggling vectors, and malformed input handling. Add your…
rub-nds/rest-attackerAutomated penetration testing framework for REST APIs with OpenAPI-driven test generation, 32 OWASP-based security tests, and built-in access control…
owasp/raiderOWASP Raider: a novel framework for manipulating the HTTP processes of persistent sessions
use-tusk/drift-node-sdkNode.js SDK for capturing and replaying API calls made to/from your service
use-tusk/tusk-cliAutomated testing suite with live traffic record and replay
santandersecurityresearch/corsair_scanAutomated CORS misconfiguration scanner that tests Origin header injection, wildcard reflection, and credential leakage across web applications and…
danialhalo/acuautomateUnofficial Acunetix CLI tool for automated pentesting and bug hunting across large scopes.
portswigger/pentest-mapperA Burp Suite Extension for Application Penetration Testing to map flows and vulnerabilities
s4dhulabs/vimana-frameworkVimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to…
