3

I am very new in security testing.

It will be very helpful if any one can suggest open-source/free tools that can run Scans for security issues (E.G SQL Injection) on REST APIs which use JSON requests.

Some services also use OAUTH.

Thanks

  • Are tools that require access to your source code OK? – Nicolas Raoul Jun 20 '16 at 8:51
  • @NicolasRaoul I thinks, I will not be given access to source code, but still I can try. Please share the tools. Thanks – Samarth Jun 20 '16 at 9:11
1

SQL Injection

Please find the following tools which can detect SQL injection vulnerabilities on web applications:

  • BSQL Hacker - an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities in virtually any database.
  • SQL Ninja - a SQL Server injection & takeover tool.
  • sqlmap - an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.
  • Absinthe - a blind SQL exploitation application.

Web-browser extensions:

Web services

Vulnerability scanners

For web penetration testing tools, see: Testing a server for security vulnerabilities

PHP

For PHP malware scanners, see: Malware scanner for websites code?

0

Following tools and frameworks can be used to do security tests for RESTful API

ZAP API Scan

https://github.com/zaproxy/zaproxy/wiki/ZAP-API-Scan

VOOKI – RestAPI Vulnerability Scanner :

Vooki is a free RestAPI Vulnerability Scanner. Its a User-friendly tool that you can easily scan the REST using GUI . It has save feature that you can repeat the scan to check whether reported vulnerability has been fixed or not.

You can download here https://www.vegabird.com/vooki/

Astra

Astra can automatically detect and test login & logout (Authentication API), so it's easy for anyone to integrate this into CICD pipeline. Astra can take API collection as an input so this can also be used for testing apis in standalone mode.

https://github.com/flipkart-incubator/Astra

Fuzzapi

Fuzzapi is rails application which uses API_Fuzzer and provide UI solution for gem.

https://github.com/Fuzzapi/fuzzapi

Burp suite You can Use Burp to Test a REST API

https://support.portswigger.net/customer/portal/articles/2898216-using-burp-to-test-a-rest-api

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.