I am new to security testing. I have been able to set things up for web applications. I want to run automated scans for my REST API. Burpsuite is a good tool but is not free. Are there any open source tools available for REST?
Secondly, I have worked on SPOCK framework for automated API testing (using Groovy). Is there any way Spock can be used for such purposes?
Thanks in advance.
The free alternative that you can look at is SoapUI.
For broadly understood security testing I'd consider a stack (eg. consisting of w3af, mitmproxy) rather than one single thing.
SPOCK supports some concepts like DDT (generally speaking it allows you to provide a set of inputs and verifiable outputs to ensure that application performs as expected with a certain range of data) and that may help indicating potential vulnerabilities, but have in mind that specific methodologies can be applied to a specific case.
