Automatic API Attack Tool vs Pentestas API Scanner
Automatic API Attack Tool
github.comPentestas API Scanner
pentestas.comSide by side
| Figure | Automatic API Attack Tool | Pentestas API Scanner |
|---|---|---|
| Price from | Free | $79/mo |
| Free plan | Yes | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| Linux | Yes | — |
| API | — | Yes |
| Plans published | 1 | 4 |
| Spec score · API Security Testing Software | 8.2 (#7) | 7.6 (#16) |
| Purpose | The tool takes an API specification as input and generates and runs attacks based on it. | API Scanner scans live APIs, analyzes Swagger/OpenAPI specifications, and decodes JWTs to inspect claims and signature weaknesses. |
| Results | The tool reports request details and whether responses matched expectations, writes TestNG results under build/testng-results, and stores bad requests in a bad_requests folder. | Findings are grouped by endpoint or claim with severity and a one-line remediation; reports can be exported as PDF, CSV, or JSON. |
| Support | The README directs users to source code documentation and gives an email address for questions; it directs bug reports to GitHub Issues. | The pricing page lists email support for Starter, priority chat for Professional, and phone support with SLA guarantees for Business. |
Plans
Pentestas API Scanner
- Starter$948 a year
- Professional$2,988 a year
- Business$5,988 a year
- EnterprisePriced on request
In their own words
Automatic API Attack Tool
Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.
Pentestas API Scanner
Pentestas API Scanner has no write-up on Specifiction yet; its figures are above.