Automatic API Attack Tool vs Bright Security DAST

Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.

Bright Security DAST is a dynamic application security testing tool offered as SaaS. It tests websites, web applications, APIs including REST, SOAP, and GraphQL, servers, and network devices; it also tests mobile applications on the server side. Checks include SQL injection, CSRF, XSS, XXE, and business logic vulnerabilities. Bright says it validates findings in real time and does not report issues it cannot validate, with less than 3% false positives among its verified findings. Target discovery can use a crawler, HAR recording, or GraphQL and OpenAPI schemas. Authentication objects let scans reach login-protected application and API resources. Teams can initiate scans from CI/CD pipelines and control them through the CLI or REST API without using the interface. The CLI's Repeater mode routes requests to local targets without exposing them to the internet. Bright lists SaaS, private cloud, and Repeater proxy deployment options. Scan quantity is unlimited, but the number of concurrent scans depends on the organization's engine count. Bright says scan data is held in memory temporarily and deleted after scanning. The tool cannot handle CAPTCHA during scans. Pricing is available on request, with a demo offered.