Pentest-Tools.com API Scanner vs VulnAPI

Pentest-Tools.com API Scanner is a cloud service for assessing APIs and detecting vulnerabilities such as SQL injection, SSRF, local file inclusion, code injection, and request URL override. It supports REST and GraphQL APIs, Postman Collections, and OpenAPI 2 and 3 specifications in YAML, YML, or JSON. Authenticated scans can use request headers, including Basic Authorization and JWT tokens. Reports include risk summaries, vulnerability evidence, remediation advice, and a list of more than 40 tests; export options vary by plan and include PDF, HTML, CSV, XLSX, or editable DOCX. Listed integrations include Jira, Slack, Microsoft Teams, Discord, webhooks, Nucleus, Vanta, Burp Suite, AWS, Azure Marketplace, GitHub Actions, and a REST API. A free plan is available. Paid plans start at $95 per month; API scanning is limited in NetSec and included in WebNetSec. The seven-day full-scanner trial requires a business email and card, and costs nothing if canceled before day eight. The company says customer data is encrypted at rest and in transit, and reports are deleted 30 days after generation.

VulnAPI is a free, open-source dynamic application security testing tool for scanning APIs for vulnerabilities and security risks. It can scan from a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint. The product page says it detects all ten OWASP API Security Top 10 categories out of the box; listed test areas include API discovery, authentication, authorization, input validation, and business logic. Reports identify risk level, vulnerability, description, and the operation where a finding occurred. Findings also include the triggering request and remediation steps in plain language. Teams can tailor assessments to their needs and run scans in GitHub Actions, GitLab CI, or Jenkins. Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available; deployment is self-hosted. The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity, but a command-line flag lets users opt out. Proxy settings can be supplied through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument. The tool is released under the MIT License and is free to use, modify, and distribute for educational and testing purposes.