Security Testing
Audit API contracts and attack running APIs to find vulnerabilities before someone else does.
All security testing tools
4- 42CrunchA commercial API security platform built on the OpenAPI contract: static audit of the definition, dynamic scanning of the running API against it, and a contract-derived runtime firewall.Paid
- Burp SuitePortSwigger's web security testing toolkit: a free Community Edition for manual testing, Professional for penetration testers, and Burp Suite DAST for scanning at scale, with API scans from OpenAPI definitions.Freemium
- StackHawkA commercial DAST platform whose HawkScan scanner runs locally or in CI against REST, GraphQL, gRPC and SOAP APIs, configured with a stackhawk.yml file in the repository.Paid
- ZAP (Zed Attack Proxy)A free, Apache-2.0 dynamic application security scanner, formerly OWASP ZAP and now published as ZAP by Checkmarx, with a packaged scan for OpenAPI, SOAP and GraphQL APIs.Open source
