Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
OFFAT — Automated API security testing tool that generates tests from OpenAPI specs, fuzzes inputs, and checks for OWASP API Top 10 vulnerabilities including SQLi, BOLA, and broken access control. | Kitploit
Tools/GitHubGitHub/owasp/offat
Vulnerability ScannersWeb Application ExploitationAPI Security TestingFuzzingAPI Security
GitHubowasp/offat

OFFAT

Automated API security testing tool that generates tests from OpenAPI specs, fuzzes inputs, and checks for OWASP API Top 10 vulnerabilities including SQLi, BOLA, and broken access control.

View Repository
663894610 days agoReviewed by Kitploit
Website

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

OWASP OFFAT

OWASP OFFAT

OFFensive Api Tester — source-aware API security testing.
Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI.

Documentation · Install · Usage · GitHub Action

Authorized use only. Live runs send real requests to the target you point OFFAT at and require an explicit --yes. Only test systems and code you own or are authorized to assess.

What it does

map -> code graph -> threat model -> test-gen -> execute (Rust) -> triage (AI) -> report
  • Map the attack surface straight from source (decorator routes, routers, OpenAPI/Swagger specs) into one canonical Bundle file.
  • Prove source-to-sink data flows on a code property graph (Python, JS/TS) and attach every finding to the HTTP route that reaches it.
  • Execute the test plan with a Rust engine over HTTP/1.1, HTTP/2, WebSocket and gRPC (HTTP/3 + QUIC opt-in), with identity-aware differential checks for BOLA / BFLA.
  • Triage with a token-disciplined AI triager (cached, batched, model-tiered) or a deterministic offline heuristic.
  • Report as SARIF 2.1.0 (with code flows), Markdown, HTML, an OWASP API Top 10 compliance report, and JUnit.

Quick start

git clone https://github.com/OWASP/OFFAT.git && cd OFFAT
pip install ./bundle ./triager './whitebox[graph]' ./graybox ./platform ./reporter
make engine                                   # Rust engine, only for live runs

# source-only: no traffic is sent
offat-platform run /path/to/repo -o app.offat.json --report-dir reports

# live, against a target you are authorized to test
offat-platform run /path/to/repo --url https://api.your-authorized-target.test \
  --identities examples/identities.example.json --yes -o app.offat.json --fail-on high

Source-only modes:

offat-whitebox /path/to/repo          # code-graph SAST + AI triage
offat-graybox  /path/to/repo          # SAST prioritized by endpoint reachability

Or use the container: docker build -t offat -f docker/Dockerfile .

Repository layout

PathWhat
bundle/the Bundle contract (schema, IO, validation)
platform/offat-platform: map, PRG, threat model, test-gen, triage
engine-rs/offat-engine: Rust execution engine
whitebox/offat-whitebox: code-graph taint engine + SAST pipeline
graybox/offat-graybox: SAST fused with endpoint reachability
triager/shared AI / heuristic triager
reporter/SARIF, Markdown, HTML, compliance reports
viz/static Bundle visualizer
docs/documentation site sources

The classic spec-only Python CLI (pip install offat, src/) has been retired in favour of the platform. Its last release remains on PyPI.

Contributing

See CONTRIBUTING.md. Issues and pull requests are welcome.

License

OWASP OFFAT is distributed under the MIT License.

Download Tool