42crunch/api-security-audit-actionAutomates static API security auditing of OpenAPI contracts in CI/CD, running 300+ checks for authentication, authorization, and data constraints,…
chaitin/safelineSelf-hosted WAF and reverse proxy that filters malicious HTTP traffic, blocks SQL injection, XSS, and bot attacks, with rate limiting and dynamic…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
projectdiscovery/katanaA next-generation crawling and spidering framework.
epi052/feroxbusterA fast, simple, recursive content discovery tool written in Rust.
s0md3v/arjunHTTP parameter discovery tool that finds valid query parameters for URL endpoints using a large dictionary, supporting GET/POST/JSON/XML requests,…
wallarm/gotestwafAn open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses
owasp/crapiDeliberately vulnerable microservices API designed for hands-on training in the OWASP API Security Top 10 risks, with built-in challenges and a…
assetnote/kiterunnerHigh-speed API and web content discovery tool that bruteforces routes using compiled Swagger datasets, supporting depth scanning, custom wordlists,…
dolevf/damn-vulnerable-graphql-applicationDamn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…
roottusk/vapivAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
denoland/clawpatrolWire-level proxy firewall for AI agents that intercepts and gates SQL, Kubernetes, and HTTP traffic using HCL rules, with per-process tunnel…
elastic/agent-skillsOfficial Elastic Skills
blst-security/cherrybombCLI tool that audits OpenAPI specifications, validates them against best practices, and runs automated security tests to detect vulnerabilities and…
dolevf/graphw00fGraphQL server engine fingerprinting tool that sends benign and malformed queries to identify backend technology and assess security defenses via the…
imperva/automatic-api-attack-toolImperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.
