Automatic API Attack Tool vs Pentest-Tools.com API Scanner

Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.

Pentest-Tools.com API Scanner is a cloud service for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs, Postman Collections, and OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers, including Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation advice, and a list of more than 40 tests; export options vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX. Listed integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. A free plan is available. Paid plans start at $95 per month; API scanning is limited in NetSec and included in WebNetSec. The seven-day full-scanner trial requires a business email and card, and costs nothing if canceled before day eight. The company says customer data is encrypted at rest and in transit, and reports are deleted 30 days after generation.