Automatic API Attack Tool vs PurpleTeam
Automatic API Attack Tool
github.comPurpleTeam
purpleteam-labs.comSide by side
| Figure | Automatic API Attack Tool | PurpleTeam |
|---|---|---|
| Price from | Free | $85/mo |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Windows | Yes | — |
| Linux | Yes | — |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 4 |
| Spec score · API Security Testing Software | 8.2 (#7) | 7.7 (#15) |
| CI/CD | The project says it was built with CI/CD in mind and describes running it in a Jenkins job triggered by a schedule or code push. | The CLI can run in headless mode within build pipelines, and the maker says teams can choose to run it on commit, on push, nightly, or at any time. |
| Support | The README directs users to source code documentation and gives an email address for questions; it directs bug reports to GitHub Issues. | The Community plan lists community Slack, GitHub Issues, GitHub Discussions, full documentation, and full source code; the Pro plan lists email support with a 48-hour response. |
Plans
PurpleTeam
- CommunityFree
- Standard$85 a month
- Pro$185 a month
- EnterprisePriced on request
In their own words
Automatic API Attack Tool
Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.
PurpleTeam
PurpleTeam is a command-line tool and service for dynamic application security testing of web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs; supported API formats include OpenAPI, SOAP, and GraphQL. The CLI runs headlessly in build pipelines, with scans scheduled on commit, push, nightly, or on demand. Results identify defect locations, provide remediation guidance and reproduction instructions, and suggest ways to find similar issues. Attack strength and alert thresholds are adjustable, including thresholds for existing defects that should not fail a run. A CLI process can run without specific integrations. Documentation describes local OWASP and cloud BinaryMist environments, with cloud onboarding by contacting the maker. Community is free, hosted locally, and includes unlimited scans, unlimited targets, and 12 concurrent test sessions. Standard costs $85 a month on annual billing; Pro costs $185 a month on annual billing. Monthly prices shown are $110 and $240. A 14-day trial is available.