Introducing tools useful for API vulnerability assessment, testing, and monitoring.
Tools that send requests to running APIs to detect vulnerabilities.
The industry-standard tool for web application and API security testing. Proxy-based interception and scanning capabilities.
Import an OpenAPI/Swagger definition to automatically crawl and test all endpoints.
An open-source security testing tool developed by OWASP. Easy to integrate into CI/CD pipelines.
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \ -t https://api.example.com/openapi.json \ -f openapi \ -r report.html
The go-to tool for API development and testing. Also useful for security testing.
// Status code validation pm.test("Status is 200", () => { pm.response.to.have.status(200); }); // Security header validation pm.test("Security headers present", () => { pm.response.to.have.header("X-Content-Type-Options"); pm.response.to.have.header("Strict-Transport-Security"); }); // Check for sensitive data exposure pm.test("No sensitive data exposed", () => { const body = pm.response.json(); pm.expect(body).to.not.have.property("password"); pm.expect(body).to.not.have.property("password_hash"); pm.expect(body).to.not.have.property("secret"); });
Quick API testing from the command line. Easy to script and automate.
# Check response headers curl -s -D - -o /dev/null https://api.example.com/health # Attempt access without authentication curl -s -w "%{http_code}" https://api.example.com/api/users # BOLA test (accessing another user's resource) curl -s -H "Authorization: Bearer $TOKEN" \ https://api.example.com/api/users/OTHER_USER_ID
A pattern-based static analysis tool. Easy to create custom rules.
Dependency vulnerability scanning and code analysis.
Vulnerability checking for package managers and containers.
npm audit: Node.js packagespip audit: Python packages# Check Node.js dependencies npm audit --production # Security scan with Semgrep semgrep --config=p/security-audit ./src # Container scan with Trivy trivy image --severity HIGH,CRITICAL myapp:latest
Define API specifications in a machine-readable format. Also used as input for security testing.
A linter tool for OpenAPI specifications. Checks compliance with security best practices.
Kong, AWS API Gateway, Apigee, and others.
AWS WAF, Cloudflare, ModSecurity, and others.
ELK Stack, Splunk, Datadog, and others.
Specialized tools for testing and securing LLMs, AI agents, and ML pipelines.
LLM vulnerability scanner that probes for prompt injection, data leakage, hallucination, and other LLM-specific weaknesses.
# Install garak pip install garak # Run prompt injection probes against an OpenAI model garak --model_type openai --model_name gpt-4 \ --probes promptinject # Run all probes and generate report garak --model_type openai --model_name gpt-4 \ --probes all --report_prefix my_audit
Addresses: LLM01: Prompt Injection, LLM06: Excessive Agency
Prompt injection detection framework with multi-layer defense: heuristics, LLM-based analysis, and vector similarity.
Addresses: LLM01: Prompt Injection
Runtime guardrails framework for LLM applications. Define conversation boundaries using Colang rules.
Addresses: LLM02: Insecure Output Handling, ASI07: Inadequate Guardrails
Python Risk Identification Tool for generative AI. Automates red-teaming with multi-turn attack strategies.
Addresses: LLM01: Prompt Injection, LLM07: Insecure Plugin Design
| Purpose | Recommended Tool | Timing |
|---|---|---|
| API specification security check | Spectral | Design / specification phase |
| Code security analysis | Semgrep | Development / PR |
| Dependency vulnerability check | Snyk / npm audit | Build time / Periodic |
| Manual security testing | Burp Suite / Postman | Testing / QA phase |
| Automated scanning (CI/CD) | OWASP ZAP | Pre-deployment |
| Production environment protection | WAF + API Gateway | In operation |
| Log monitoring and anomaly detection | SIEM (ELK / Datadog) | In operation / Continuous |
| LLM vulnerability scanning | Garak / PyRIT | Pre-deployment / Periodic |
| Prompt injection detection | Rebuff | Runtime / Integration |
| LLM runtime guardrails | NeMo Guardrails | Runtime / Continuous |
| AI red-teaming automation | PyRIT | Testing / QA phase |
| AI model supply chain verification | Semgrep / ModelScan | Build time / Pre-deployment |