Release ASTF v2.0.0 · OWASP/www-project-api-security-testing-framework

OWASP API Security Testing Framework v2.0.0

# Download the JAR from Assets below, then:
java -jar astf-v2.0.0.jar -u https://api.example.com -f HTML -o results.html -v

16 security test cases — full OWASP API Security Top 10 2023 + GraphQL, gRPC, mutual TLS, LLM prompt injection, general SQL/NoSQL injection, and ReDoS
Cross-user authorization testing (--secondary-token) for BOLA, mutual TLS client-certificate validation
Output formats: JSON, HTML, SARIF, XML
Auto endpoint discovery
350 passing unit tests

See the README
and docs/
for full documentation.

chore: gitignore build/scan artifacts, untrack accidental commit by @GovindarajanL in #69
fix: weak-credential check now inspects response body, not just HTTP status by @GovindarajanL in #75
fix: GraphQL depth-limit probe uses real schema fields instead of guessed names by @GovindarajanL in #76
fix: gRPC detection can now connect to real (h2c) gRPC servers by @GovindarajanL in #77
fix: discovery no longer mistakes 404 error pages for real endpoints by @GovindarajanL in #78
fix: scan can no longer hang indefinitely past its configured timeout by @GovindarajanL in #79
fix: 7 structural bugs in BOPLA, SSRF, BFLA, inventory-mgmt, misconfig, resource-consumption, unsafe-consumption checks by @GovindarajanL in #93
feat: cross-user BOLA, mTLS validation, LLM prompt injection, deeper GraphQL/gRPC coverage by @GovindarajanL in #94
fix: close 8 structural coverage gaps + robustness pass (#95-102 + 3 more) by @GovindarajanL in #104
ci: add explicit workflow-level permissions to ci by @arpitjain099 in #68
docs: add API Security Testing Guidelines (closes #24) by @GovindarajanL in #105
docs: bring the public OWASP project page (index.md) up to date by @GovindarajanL in #106
chore(release): prepare v2.0.0 by @GovindarajanL in #107

Full Changelog: v1.0.0...v2.0.0