I am new to security testing. I have been able to set things up for web applications. I want to run automated scans for my REST API. Burpsuite is a good tool but is not free. Are there any open source tools available for REST?

Secondly, I have worked on SPOCK framework for automated API testing (using Groovy). Is there any way Spock can be used for such purposes?

Thanks in advance.

1 Answer 1


The free alternative that you can look at is SoapUI.

For broadly understood security testing I'd consider a stack (eg. consisting of w3af, mitmproxy) rather than one single thing.

SPOCK supports some concepts like DDT (generally speaking it allows you to provide a set of inputs and verifiable outputs to ensure that application performs as expected with a certain range of data) and that may help indicating potential vulnerabilities, but have in mind that specific methodologies can be applied to a specific case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.