I am very new in security testing.

It will be very helpful if any one can suggest open-source/free tools that can run Scans for security issues (E.G SQL Injection) on REST APIs which use JSON requests.

Some services also use OAUTH.


  • Are tools that require access to your source code OK?
    – Nicolas Raoul
    Jun 20, 2016 at 8:51
  • @NicolasRaoul I thinks, I will not be given access to source code, but still I can try. Please share the tools. Thanks
    – Samarth
    Jun 20, 2016 at 9:11

2 Answers 2


SQL Injection

Please find the following tools which can detect SQL injection vulnerabilities on web applications:

  • BSQL Hacker - an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities in virtually any database.
  • SQL Ninja - a SQL Server injection & takeover tool.
  • sqlmap - an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws.
  • Absinthe - a blind SQL exploitation application.

Web-browser extensions:

Web services

Vulnerability scanners

For web penetration testing tools, see: Testing a server for security vulnerabilities


For PHP malware scanners, see: Malware scanner for websites code?


Following tools and frameworks can be used to do security tests for RESTful API



VOOKI – RestAPI Vulnerability Scanner :

Vooki is a free RestAPI Vulnerability Scanner. Its a User-friendly tool that you can easily scan the REST using GUI . It has save feature that you can repeat the scan to check whether reported vulnerability has been fixed or not.

You can download here https://www.vegabird.com/vooki/


Astra can automatically detect and test login & logout (Authentication API), so it's easy for anyone to integrate this into CICD pipeline. Astra can take API collection as an input so this can also be used for testing apis in standalone mode.



Fuzzapi is rails application which uses API_Fuzzer and provide UI solution for gem.


Burp suite You can Use Burp to Test a REST API


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.