owasp-api-security

API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates

Async API security scanner in Rust for CORS, CSP, GraphQL, JWT, OpenAPI, and active API posture checks.

Professional API security auditing tool that detects rate limiting vulnerabilities and misconfigurations in REST APIs

Built in the trenches—this repository captures real-world API security insights, attack techniques, and practical penetration testing workflows.

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

Intentionally vulnerable ASP.NET Core Web API for hands-on study of the OWASP API Security Top 10 2023.

Intentionally vulnerable e-commerce lab for practicing web & API pentesting (OWASP Top 10 2025 + API Top 10 2023). 15 vulns, each with an on/off fix, exploit check and teaching sheet. Localhost only, fictional data.

API-to-OT attack detection lab: crAPI + Conpot ICS honeypot + Grafana/Loki on Proxmox. Demonstrates BOLA, broken auth, and SSRF-to-OT pivot detection.

Go-based CLI tool for testing REST APIs against BOLA/IDOR, JWT auth bypass, and mass assignment vulnerabilities — parses OpenAPI specs, tests cross-user authorization with body-diff confirmation, and outputs severity-scored JSON reports.

Safe, reproducible API pentesting and Purple Team lab featuring vulnerable and protected FastAPI implementations, OWASP-mapped attacks, security detections, and regression testing.

Secure healthcare API security demo in .NET 10 demonstrating JWT authentication, RBAC, audit logging, HIPAA-inspired access controls, secure middleware, and OWASP API Security concepts.

Production-style API security observability lab with Kong Gateway, Flask, Prometheus, Loki, Grafana, active attack blocking, OWASP API validation, SOC dashboards, and compliance evidence.

Defensive API security testing templates for Postman and Newman, with OWASP-aligned collections, safe payloads, CI/CD automation, and vulnerable local labs.

Check an OpenAPI description against the OWASP API Security Top 10: missing authentication, API keys in URLs, object access, size limits, SSRF-prone URL fields and plain HTTP servers. Zero dependencies.

API QA suite: pytest + schemathesis + OWASP API Top 10 checks