awesome-api-security

Mind map: REST API defenses

Mind map: GraphQL Attacking

Organize your API security assessment by using MindAPI

Mind map: XML attacks

Mind map: OWASP API Top 10

Mind map: IDOR Techniques

API discovery, automated business logic testing and runtime detection

The DevSecOps toolset for REST APIs.

Reconstruct Open API Specifications from real-time workload traffic seamlessly.

Fuzz test your application using your OpenAPI or Swagger API definition without coding.

APIKit：Discovery, Scan and Audit APIs Toolkit All In One.

HTTP parameter discovery suite.

What are API and microservice security?

API Hacking Fundamentals, Tools, Techniques, Fails and Mindset articles.

API Penetration Testing with OWASP 2017 Test Cases.

Anonymised API Penetration Testing Report - vendor sample template

Simplifying API Pentesting With Swagger Files.

API Security Best Practices MegaGuide

API Audit is a method to ensure APIs are matching the API Design guidelines. It also helps check for usability, security and API management platform compatibility.

API security design best practices for enterprise and public cloud.

A collaborative list of great resources about RESTful API architecture, development, test, and performance. Feel free to contribute to this ongoing list.

Collecting Requirements for your API with APIOps Cycles.

How to design a REST API? - Full guide tackling security, pagination, filtering, versioning, partial answers, CORS, etc.

This design guide or style guide contains best practices suitable for most REST APIs.

API Blueprint Specification

AsyncAPI Specification

GraphQL Specification

JSON API Specification

OpenAPI Specification

RAML Specification

Simple website to guess API Key / OAuth Token by Muhammad Daffa

An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares.

Go scripts for checking API key / access token validity.

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

A tool used to hunt down API key leaks in JS files and pages

Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user.

API hacking videos from @theXSSrat

A video collection from Katie Paxton-Fear, @InsiderPhD, and other people creating a playlist of API hacking knowledge!

HTTP requests methods wordlist by @danielmiessler

A wordlist of API names for web application assessments

API Routes - Automated Wordlists provided by Assetnote

Wordlist for common API endpoints.

Potentially dangerous files

Fuzzing APIs chapter from "The Fuzzing Book".