Skip to content
SPECIFICTION
Get listed

Automatic API Attack Tool

github.com

Free plan WindowsLinux
Visit github.com
Spec score 8.2 #7 of 27 in API Security Testing Software

What it is

Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.

Spec sheet

Purpose
The tool takes an API specification as input and generates and runs attacks based on it.Read 8 Oct 2026 · github.com
Support
The README directs users to source code documentation and gives an email address for questions; it directs bug reports to GitHub Issues.Read 8 Oct 2026 · github.com
License
The repository lists an MIT license.Read 8 Oct 2026 · github.com
API format
The required specification is Swagger 2.0 in JSON or YAML format.Read 8 Oct 2026 · github.com
Attack generation
It creates fuzzing scenarios by sending generated values within and outside the boundaries defined in the API specification.Read 8 Oct 2026 · github.com
Attack vectors
The README says the tool can be extended to run attacks such as illegal resource access, XSS, SQL injection, and RFI.Read 8 Oct 2026 · github.com
CI/CD
The project says it was built with CI/CD in mind and describes running it in a Jenkins job triggered by a schedule or code push.Read 8 Oct 2026 · github.com
Extensibility
The project says its fuzzing and request generation functionality can be extended for specific needs.Read 8 Oct 2026 · github.com
Fuzzing
It creates positive and negative fuzzing scenarios using generated parameter values that follow or violate the API specification.Read 8 Oct 2026 · github.com
Limits
The README says the required API specification must be Swagger 2.0 and recommends precisely defining legitimate response codes for endpoints.Read 8 Oct 2026 · github.com
Linux
The README describes combining a runnable shell script with the JAR to make a Linux executable.Read 8 Oct 2026 · github.com
Proxy support
Optional arguments let users route requests through a proxy by specifying its host and port.Read 8 Oct 2026 · github.com
Reporting
The tool writes TestNG results under `build/testng-results`, prints check details and a summary, and stores bad requests in a `bad_requests` folder.Read 8 Oct 2026 · github.com
Requirements
Running the tool requires Java 8 or higher and Gradle.Read 8 Oct 2026 · github.com
Results
The tool reports request details and whether responses matched expectations, writes TestNG results under build/testng-results, and stores bad requests in a bad_requests folder.Read 8 Oct 2026 · github.com
Specification support
The required specification is Swagger 2.0 in JSON or YAML format.Read 8 Oct 2026 · github.com
Test scenarios
Supported scenarios include requests with generated valid values and requests that inject a random invalid value into each checked parameter.Read 8 Oct 2026 · github.com
Windows
The README gives `gradlew.bat build` as the Windows build command.Read 8 Oct 2026 · github.com
Windows and Linux
The README gives build instructions for Windows and describes how to create a Linux executable.Read 8 Oct 2026 · github.com

Plans and prices

MIT-licensed open-source tool Free Java 8 or higher · Gradle · Swagger 2.0 API specification Read 8 Oct 2026 · github.com

Every Automatic API Attack Tool plan and price →

Strong points and limits

Strong points

  • Free and MIT-licensed
  • Generates positive and negative fuzzing scenarios
  • Supports authorization and input-validation testing
  • Provides TestNG and bad-request outputs
  • Can run in Jenkins CI/CD jobs

Limits

  • Requires Swagger 2.0 specifications
  • Needs Java 8 or higher and Gradle
  • Does not discover APIs
  • Self-hosted deployment is required

Who it suits

It suits security and development teams with Swagger 2.0 API definitions who want self-hosted fuzzing in Windows, Linux, or CI/CD workflows. Users must provide the required specification and build dependencies.

Verdict

This tool turns Swagger 2.0 definitions into executable API attack and fuzzing scenarios, with files and summaries for review. Its format requirement, build dependencies, and lack of API discovery define the setup.

Where Specifiction places it

Alternatives to Automatic API Attack ToolAll alternatives →