vulnapi: Scan APIs for Security Vulnerabilities

Overview

VulnAPI is a command-line dynamic application security testing (DAST) tool for finding common vulnerabilities and weaknesses in APIs. It can inspect a target for useful API information, exposed files, and well-known paths, then report findings associated with API operations.

It supports scans driven by curl-like CLI options or an OpenAPI contract, and reports risk levels, CVSS scores, and OWASP categories. It is intended for developers and security practitioners testing APIs they are authorized to assess, rather than as a replacement for manual review or a complete security program.

Key Features

• Discover API-related endpoints, well-known paths, exposed files, and technology information.
• Scan targets with curl-like CLI commands and options.
• Scan API operations described by an OpenAPI contract.
• Report findings with risk levels, CVSS 4.0 scores, OWASP categories, and affected operations.
• Configure proxy use with HTTP_PROXY, HTTPS_PROXY, or the --proxy option.
• Generate JWT tokens with the jwt command.
• Opt out of anonymous usage statistics and crash reports with --sqa-opt-out.

Use Cases

• API developers can check an endpoint for common security misconfigurations during development.
• Security teams can assess an API described by an OpenAPI contract as part of an authorized review.
• Testers can discover exposed API documentation, well-known paths, and files before conducting a deeper assessment.
• Teams whose API targets are reachable through a proxy can route scans through their configured proxy.

Getting Started

Install VulnAPI using the installation documentation, then discover a target with:

vulnapi discover api [API_URL]

See the repository README for scan commands, options, and further instructions.

Considerations

• Scans should only be run against systems you own or are authorized to test. The project explicitly disclaims malicious or unauthorized use.
• VulnAPI collects anonymous scan counts, vulnerability counts, severity information, and crash reports. The README says no sensitive information is collected and documents the --sqa-opt-out flag.
• The README describes the scanner as covering common vulnerabilities and weaknesses, with more checks planned. Review the documented vulnerability list to assess whether its checks fit your requirements.
• The repository provides CLI scanning workflows, not evidence that findings replace manual validation or other security testing.