An open-source project in Golang to test different web application firewalls (WAF) for detection logic and bypasses ... Contextual Content Discovery Tool. ... Open-source API security tool to discover, inventory, test, and protect your APIs.

December 21, 2025 - Here are our top picks for open-source API security tools: APIsec Scan enables continuous, automated API security testing by discovering endpoints, running tailored attack playbooks, and integrating results into CI/CD workflows.

StackHawk is free for Open Source projects and free to use on a single application. VWT Digital’s sec-helpers - Collection of dynamic security related helpers. Sec-helpers is a bundle of useful tests and validators to ensure the security of a given domain. WuppieFuzz is a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity.

Supports REST and GraphQL APIs with positive security model. Open sourced. | | | | AI-powered, fully managed API protection against OWASP API Top 10 threats, DDoS and bot attacks. Unified platform for API discovery, vulnerability scanning and protection · | | | | A complete vulnerability analysis and penetration testing platform for APIs

April 17, 2026 - Compare the top open-source API security tools — OWASP ZAP, Nuclei, mitmproxy, 42Crunch, Escape, Bearer — tested for REST and GraphQL API coverage.

This is a user-friendly open-source tool for performing security, compliance, functional, and load testing on your APIs and web services. The security testing features will help provide a secure API environment for your target services, especially the more vulnerable public-facing apps.

Karate is an open source framework that combines automated API testing, performance testing and mocking into a single framework. While it is implemented in Java, it doesn't require users to have advanced programming skills.

March 19, 2026 - Here’s a short list of the top API pentesting tools if you are short on time: Burp Suite: Best overall manual API security testing work surface · ZAP by Checkmarx (OWASP ZAP): Best open-source API testing baseline

A clean, unified experience that shortens the path from design to secure validation. Our 2026 top five are TestSprite, Postman, OWASP ZAP, Burp Suite, and Apidog. These tools collectively cover autonomous AI-driven testing, collaboration, open-source DAST, pentester-grade depth, and low-code ...

June 11, 2025 - OWASP ZAP (Zed Attack Proxy) remains a popular choice for automated penetration testing, offering a wide array of API-specific add-ons. For developers, integrating security directly into their workflows is crucial.

June 23, 2025 - Astra helps identify and fix vulnerabilities with automated scanning, detailed reports, and remediation guidance. OWASP ZAP (Zed Attack Proxy) is an open source web application security scanner that supports API security testing.

August 12, 2026 - JMeter is a flexible tool frequently used for API performance and security testing. ... A complete set of functionalities for developing, debugging, and testing APIs can be found in the open-source API security testing tool called Insomnia.

JWT_Tool is a toolkit for testing, tweaking and cracking JSON Web Tokens. ... Kiterunner is a tool that performs traditional content discovery, and also bruteforces routes/endpoints in modern applications. ... Converts mitmproxy captures to OpenAPI 3.0 specifications. Automatically reverse-engineer REST APIs by just running the apps and capturing the traffic. ... Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions.

2 weeks ago - StackHawk is ideal for developer-led teams that want API security scans on every pull request. ZAP is a free, open-source scanner and intercepting proxy. Its packaged API scan runs from a Docker image, imports OpenAPI, SOAP, or GraphQL definitions, and runs an active scan tuned for APIs that skips browser-focused checks like XSS. Business logic and authorization flaws still require manual testing. ZAP fits teams building baseline API coverage without a tooling budget.

January 10, 2023 - A roundup of up some helpful open-source security testing utilities, open standards, and free identity management solutions that can be used to help build and test a zero-trust API architecture.

November 17, 2025 - ... Developers using Postman can enhance workflow security by referencing the Best API Documentation Tools to ensure clear, enforceable specifications. Overview ZAP (Zed Attack Proxy) is a free, open-source DAST tool supported by the OWASP community.

December 24, 2025 - Learn more about effective penetration testing with GraphQL. Checkmarx ZAP, developed as an OWASP project, is an open-source dynamic security application testing (DAST) tool that can be used as a proxy serve for API scanning.

August 25, 2026 - Metlo is not testing-only either: its own summary covers detecting bad actors and blocking malicious traffic in real time, so it spans two of the three categories above. Best for: Teams that want a self-hosted open-source option and will evaluate project health themselves. 42Crunch is an OpenAPI-centric lifecycle platform with three named components. API Security Audit checks the definition at design time, API Scan tests the deployed API, and API Protection defends it at runtime through what 42Crunch calls an API-native micro firewall.