openapi-parser
aress31/openapi-parserParse OpenAPI documents into Burp Suite for automating OpenAPI-based APIs security assessments (approved by PortSwigger for inclusion in their…
api-securityapi-security-testingpenetration-testing+2
210
aress31/openapi-parserParse OpenAPI documents into Burp Suite for automating OpenAPI-based APIs security assessments (approved by PortSwigger for inclusion in their…
akabe1/oauthscanBurp Suite Extension useful to verify OAUTHv2 and OpenID security
xaaha/hulakA lightweight, file-based CLI API client with age-encrypted secrets, first-class GraphQL support, and a built-in MCP server for AI agent workflows.
manuelberrueta/flowanalyzerFlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).
owasp/apicheckModular DevSecOps toolset for REST API security testing, designed for developers, sysadmins, and penetration testers to automate security checks…
piratesshield/apiharvesterThe one shot API attacker tool - finds the API url from the given root simulate the automated attacks
synacktiv/burp-jqBurp extension to filter JSON on the fly with JQ queries in the HTTP message viewer.
nccgroup/httpsignaturesA Burp Suite extension implementing the Signing HTTP Messages draft-ietf-httpbis-message-signatures-01 draft.
m4xsec/apache-apisix-cve-2022-24112Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept exploit
cspf-founder/api-scanner-dockerAutomated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specs and WSDL files. Deploys a full …
george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…
dz-y/azure-apim-dev-portal-signup-bypassPython script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…
nel-droid/cve-2026-71203-pocPoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)
sunandm/poc-h2-cve-2026-71554PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)
george0papasotiriou/cve-2026-22014-graphql-persisted-queries-injection-via-id-manipulationProof-of-concept exploit for CVE-2026-22014 demonstrating persisted-query ID manipulation in GraphQL APIs to bypass allowlists and execute arbitrary…
penteraio/cve-2026-41473-cyberpanel-ai-scanner-unauthNuclei detection template for CVE-2026-41473, an unauthenticated read/write API access flaw in CyberPanel AI Scanner before 2.4.4. Uses two HTTP…
shoucheng3/apache__dubbo_cve-2021-30180_2-7-9Exploit for CVE-2021-30180 targeting Apache Dubbo RPC framework, enabling remote code execution via crafted RPC requests in vulnerable versions.
shoucheng3/spring-cloud__spring-cloud-gateway_cve-2022-22947_3-0-6Spring Cloud Gateway repository demonstrating CVE-2022-22947 exploitation for API security testing and vulnerability analysis.