OpenSource Security scan tools for REST APIs

Question

I am very new in security testing.

It will be very helpful if any one can suggest open-source/free tools that can run Scans for security issues (E.G SQL Injection) on REST APIs which use JSON requests.

Some services also use OAUTH.

Thanks

Answer 1

SQL Injection

Please find the following tools which can detect SQL injection vulnerabilities on web applications:

• BSQL Hacker - an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities in virtually any database.
• SQL Ninja - a SQL Server injection & takeover tool.
• sqlmap - an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.
• Absinthe - a blind SQL exploitation application.

Web-browser extensions:

• Websecurify (Chrome/Firefox) - web security testing toolkit
• HackBar for Firefox,
• SQL Injection for Firefox,
• SQL Inject Me for Firefox by Security Compass

Web services

• Scan Titan - scan for website vulnerabilities.

Vulnerability scanners

For web penetration testing tools, see: Testing a server for security vulnerabilities

PHP

For PHP malware scanners, see: Malware scanner for websites code?

Answer 2

Following tools and frameworks can be used to do security tests for RESTful API

ZAP API Scan

https://github.com/zaproxy/zaproxy/wiki/ZAP-API-Scan

VOOKI – RestAPI Vulnerability Scanner :

Vooki is a free RestAPI Vulnerability Scanner. Its a User-friendly tool that you can easily scan the REST using GUI . It has save feature that you can repeat the scan to check whether reported vulnerability has been fixed or not.

You can download here https://www.vegabird.com/vooki/

Astra

Astra can automatically detect and test login & logout (Authentication API), so it's easy for anyone to integrate this into CICD pipeline. Astra can take API collection as an input so this can also be used for testing apis in standalone mode.

https://github.com/flipkart-incubator/Astra

Fuzzapi

Fuzzapi is rails application which uses API_Fuzzer and provide UI solution for gem.

https://github.com/Fuzzapi/fuzzapi

Burp suite You can Use Burp to Test a REST API

https://support.portswigger.net/customer/portal/articles/2898216-using-burp-to-test-a-rest-api