graphw00f
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
api-securityapi-security-testingdynamic-code-analysis+5
899
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
akabe1/oauthscanBurp Suite Extension useful to verify OAUTHv2 and OpenID security
manuelberrueta/flowanalyzerFlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).
portswigger/pentest-mapperA Burp Suite Extension for Application Penetration Testing to map flows and vulnerabilities
s4dhulabs/vimana-frameworkVimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to…
owasp/apicheckModular DevSecOps toolset for REST API security testing, designed for developers, sysadmins, and penetration testers to automate security checks…
george0papasotiriou/cve-2026-22014-graphql-persisted-queries-injection-via-id-manipulationProof-of-concept exploit for CVE-2026-22014 demonstrating persisted-query ID manipulation in GraphQL APIs to bypass allowlists and execute arbitrary…
penteraio/cve-2026-41473-cyberpanel-ai-scanner-unauthNuclei detection template for CVE-2026-41473, an unauthenticated read/write API access flaw in CyberPanel AI Scanner before 2.4.4. Uses two HTTP…
dz-y/azure-apim-dev-portal-signup-bypassPython script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…
5qu1n7/cve-2025-55817ChilliCream Nitro GraphQL version 28.0.13 is vulnerable to multiple Stored Cross Site Scripting (XSS) Vulnerabilities
shoucheng3/vert-x3__vertx-web_cve-2018-12542_3-5-3-cr1Exploit for CVE-2018-12542 in Vert.x-Web, a Java web framework. Demonstrates a path traversal vulnerability allowing unauthorized access to static…
owasp/crapiDeliberately vulnerable microservices API designed for hands-on training in the OWASP API Security Top 10 risks, with built-in challenges and a…
dolevf/damn-vulnerable-graphql-applicationDamn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…
owasp/offatAutomated API security testing tool that generates tests from OpenAPI specs, fuzzes inputs, and checks for OWASP API Top 10 vulnerabilities including…
metlo-labs/metloMetlo is an open-source API security platform.
elastic/agent-skillsOfficial Elastic Skills
dolevf/graphql-copLightweight Python utility for automated security auditing of GraphQL APIs. Detects misconfigurations, information leaks, and denial-of-service…
aress31/openapi-parserParse OpenAPI documents into Burp Suite for automating OpenAPI-based APIs security assessments (approved by PortSwigger for inclusion in their…