graphw00f
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
api-securityapi-security-testingdynamic-code-analysis+5
884
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
imperva/automatic-api-attack-toolImperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
lumoslab-innovation/openhunteraiLocal-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI coding…
dolevf/graphql-copLightweight Python utility for automated security auditing of GraphQL APIs. Detects misconfigurations, information leaks, and denial-of-service…
teycir/burpapisecuritysuiteBurp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and…
lucky-luk3/grafikiThreat Hunting tool about Sysmon and graphs
tno-s3/wuppiefuzzA coverage-guided REST API fuzzer developed on top of LibAFL
aress31/openapi-parserParse OpenAPI documents into Burp Suite for automating OpenAPI-based APIs security assessments (approved by PortSwigger for inclusion in their…
lucksec/spring-cloud-gateway-cve-2022-22947Exploit for CVE-2022-22947: remote code execution in Spring Cloud Gateway via crafted requests to the Actuator endpoint. Includes Python script and…
blackfan/bfscanTool for finding URLs, paths, secrets and generating raw HTTP requests and OpenApi specifications from config files and annotations used in JAR / WAR…
wuppp/cve-2021-45232-expExploit for CVE-2021-45232 targeting Apache APISIX Dashboard remote code execution vulnerability. Provides proof-of-concept for security testing and…
xaaha/hulakA lightweight, file-based CLI API client with age-encrypted secrets, first-class GraphQL support, and a built-in MCP server for AI agent workflows.
alt3kx/cve-2022-1388_pocF5 BIG-IP RCE exploitation (CVE-2022-1388)
manuelberrueta/flowanalyzerFlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).
jas502n/springboot_actuator_rceSpringBoot_Actuator_RCE
0xdad0/papimonitorFrida-based runtime API monitor for Android apps that logs invoked APIs, parameters, return values, and call origins across predefined or custom…
s4dhulabs/vimana-frameworkVimana is a modular security framework for auditing Python APIs and Web applications. The plugin-based architecture enables security professionals to…
nccgroup/jwt-reauthCaches JWT authentication tokens from an auth URL and attaches them as headers to in-scope requests in Burp Suite for automated session handling.