vulnapi - API Security Vulnerability Scanner designed to hel

项目说明

<p align="center">
<img src=" height="150" alt=" logo">
</p>

---

![Join Discord]()
![GitHub Workflow Status]()
!Latest
![Github Repo Stars]()
!License

: An API Security Scanner

is an Open-Source DAST designed to help you scan your APIs for common security and weaknesses.

By using this tool, you can detect and mitigate security in your APIs before they are exploited by attackers.

!Demo

Installation

Before making your first scan with , you have to download and install it. Please follow the instructions on the Installation documentation page.

Documentation

Before scanning, you can disco API useful information by using the discover command.

The Scanner CLI offers two methods for scanning APIs:
* Using Curl-like CLI: This method in directly in the CLI with parameters resembling curl commands.
* Using OpenAPI Contracts: This method utilizes OpenAPI contracts to specify API endpoints for scanning.

Disco

To disco API useful information, leaked files and well-known path execute the following command:

Example output:

Using Curl-like CLI

To perform a scan using the Curl-like CLI, execute the following command:

Replace [API_URL] with the URL of the API to scan, and [CURL_OPTIONS] with any additional curl options you wish to include.

Using OpenAPI Contracts

To perform a scan using OpenAPI contracts, execute the following command:

Replace [PATH_OR_URL_TO_OPENAPI_FILE] with the path or the URL to the OpenAPI contract JSON file and [JWT_TOKEN] with the JWT token to use for authentication.

Output

The CLI provides detailed reports on any detected during the scan. Below is an example of the output format:

| TECHNOLOGIE/SERVICE | VALUE |
|---------------------|---------------|
| Framework | Flask:2.2.3 |
| Language | Python:3.11.9 |
| Server | Flask:2.2.3 |

Advice: There are some low-risk issues. It's advised to take a look.

| OPERATION | RISK LEVEL | CVSS 4.0 SCORE | OWASP | |
|------------------------------|------------|----------------|--------------------------------|--------------------------------|
| GET / | Medium | 5.1 | API8:2023 Security | X-Frame-Options Header is |
| | | | Misconfiguration | missing |
| | Medium | 5.1 | API8:2023 Security | CORS Headers are missing |
| | | | Misconfiguration | |
| | Medium | 5.1 | API8:2023 Security | CSP frame-ancestors policy is |
| | | | Misconfiguration | not set |
| | Info | 0.0 | API8:2023 Security | X-Content-Type-Options Header |
| | | | Misconfiguration | is missing |
| | Info | 0.0 | API8:2023 Security | Operation May Accepts |
| | | | Misconfiguration | Unauthenticated Requests |
| | Info | 0.0 | API8:2023 Security | HSTS Header is missing |
| | | | Misconfiguration | |
| | Info | 0.0 | API8:2023 Security | CSP Header is not set |
| | | | Misconfiguration | |
| GET /books/v1 | Medium | 5.1 | API8:2023 Security | CSP frame-ancestors policy is |
| | | | Misconfiguration | not set |
| | Medium | 5.1 | API8:2023 Security | X-Frame-Options Header is |
| | | | Misconfiguration | missing |
| | Medium | 5.1 | API8:2023 Security | CORS Headers are missing |
| | | | Misconfiguration | |
| | Info | 0.0 | API8:2023 Security | CSP Header is not set |
| | | | Misconfiguration | |
| | Info | 0.0 | API8:2023 Security | HSTS Header is missing |
| | | | Misconfiguration | |
| | Info | 0.0 | API8:2023 Security | X-Content-Type-Options Header |
| | | | Misconfiguration | is missing |
| | Info | 0.0 | API8:2023 Security | Operation May Accepts |
| | | | Misconfiguration | Unauthenticated Requests

In this example, each line represents a detected , se level (critical), type, affected operation (GET ), and a description of the .

Detected

All the detected by the project are listed at this URL: API Detected.

> More and best practices will be added in future releases. If you have any suggestions or requests for additional or best practices to be included, please feel free to open an issue or submit a pull request.

Proxy Support

The scanner supports proxy configurations for scanning APIs behind a proxy server. To use a proxy, set the HTTP_PROXY or HTTPS_PROXY en with the proxy URL.

A command arg --proxy is also a to specify the proxy URL.

Additional Options

The may support additional options for customizing scans or output formatting. Run -h or help command to view a options and their descriptions.

Telemetry

The scanner collects anonymous usage data to help improve the tool. This data includes the number of scans performed, number of detected , and the se of . No sensiti is collected. You can opt-out of telemetry by passing the --sqa-opt-out flag.

Complete CLI Help

To view the complete CLI help, execute the following command:

Here is the output of the help command:

Disclaimer

This scanner is provided for educational and informational purposes only. It should not be used for malicious purposes or to attack any system without proper authorization. Always respect the security and privacy of others.

Thanks

This project used the following open-source libraries:
* jwtop
* SecLists
* projectdiscovery/wappalyzergo

License

This repository is licensed under the MIT License @ CerberAuth. You are free to use, modify, and distribute the contents of this repository for educational and testing purposes.

项目信息

开发语言：Go

Star 数：284

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕API Security Vulnerability Scanner designed to help you secure your APIs.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。