Automatic API Attack Tool vs VulnAPI

Automatic API Attack Tool is a free, MIT-licensed, self-hosted security tool for Windows and Linux. It takes a Swagger 2.0 API specification in JSON or YAML and generates and runs attacks from that definition. Fuzzing scenarios send generated values within the specification’s boundaries and values that violate them, including random invalid values for checked parameters. The project describes extensibility for attack types such as illegal resource access, XSS, SQL injection, and RFI, and supports authorization and input-validation testing. It reports request details, expected-response checks, and a summary. TestNG results are written under build/testng-results, while bad requests are saved in a bad_requests folder. Optional host and port arguments support routing through a proxy. The project is intended for CI/CD and describes scheduled or code-push Jenkins jobs. Running it requires Java 8 or higher and Gradle. Windows build instructions use gradlew.bat build; Linux instructions create an executable from a shell script and the JAR. API discovery is not included.

VulnAPI is a free, open-source dynamic application security testing tool for scanning APIs for vulnerabilities and security risks. It can scan from a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint. The product page says it detects all ten OWASP API Security Top 10 categories out of the box; listed test areas include API discovery, authentication, authorization, input validation, and business logic. Reports identify risk level, vulnerability, description, and the operation where a finding occurred. Findings also include the triggering request and remediation steps in plain language. Teams can tailor assessments to their needs and run scans in GitHub Actions, GitLab CI, or Jenkins. Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available; deployment is self-hosted. The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity, but a command-line flag lets users opt out. Proxy settings can be supplied through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument. The tool is released under the MIT License and is free to use, modify, and distribute for educational and testing purposes.