OWASP API Security Testing Framework v2.0.1
Quick Start
# Download the JAR from Assets below, then:
java -jar astf-v2.0.1.jar -u https://api.example.com -f HTML -o results.html -vRequirements
- Java 21+
What's included
- 16 security test cases — full OWASP API Security Top 10 2023 + GraphQL, gRPC, mutual TLS, LLM prompt injection, general SQL/NoSQL injection, and ReDoS
- Cross-user authorization testing (
--secondary-token) for BOLA, mutual TLS client-certificate validation - Output formats: JSON, HTML, SARIF, XML
- Auto endpoint discovery
- 350 passing unit tests
See the README
and docs/
for full documentation.
What's Changed
- fix: resolve version dynamically instead of hardcoding it everywhere by @GovindarajanL in #108
- chore(release): prepare v2.0.1 by @GovindarajanL in #109
Full Changelog: v2.0.0...v2.0.1
Contributors
GovindarajanL