I am very new in security testing.
It will be very helpful if any one can suggest open-source/free tools that can run Scans for security issues (E.G SQL Injection) on REST APIs which use JSON requests.
Some services also use OAUTH.
Please find the following tools which can detect SQL injection vulnerabilities on web applications:
sqlmap- an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.
For web penetration testing tools, see: Testing a server for security vulnerabilities
For PHP malware scanners, see: Malware scanner for websites code?
Following tools and frameworks can be used to do security tests for RESTful API
ZAP API Scan
VOOKI – RestAPI Vulnerability Scanner :
Vooki is a free RestAPI Vulnerability Scanner. Its a User-friendly tool that you can easily scan the REST using GUI . It has save feature that you can repeat the scan to check whether reported vulnerability has been fixed or not.
You can download here https://www.vegabird.com/vooki/
Astra can automatically detect and test login & logout (Authentication API), so it's easy for anyone to integrate this into CICD pipeline. Astra can take API collection as an input so this can also be used for testing apis in standalone mode.
Fuzzapi is rails application which uses API_Fuzzer and provide UI solution for gem.
Burp suite You can Use Burp to Test a REST API