🔒 API Security Auditor Pro

🔒 API Security Auditor Pro

Advanced Open Source API Security Auditor Pro

🎯 What is API Security Auditor Pro?

API Security Auditor Pro is a professional command-line tool designed to help developers and security engineers test the security of their APIs. It automatically detects common security vulnerabilities and misconfigurations.

Key Features

✅ Rate Limiting Detection - Test if your API can handle brute force attacks
🔍 Security Headers Check - Identify missing security headers
🚨 Vulnerability Scanning - Detect common API vulnerabilities
📊 Multiple Output Formats - JSON, HTML, CSV reports
🐳 Docker Support - Run anywhere without installation
⚡ Fast & Lightweight - Minimal dependencies, maximum performance

🚀 Installation

From PyPI (Recommended)

pip install api-security-auditor-pro

From Source

git clone https://github.com/miladrezanezhad/api-security-auditor-pro.git
cd api-security-auditor-pro
pip install -e .

With Docker

docker pull miladrezanezhad/api-security-auditor-pro
docker run miladrezanezhad/api-security-auditor-pro --help

🎬 Quick Start

1. Scan an API Endpoint

api-auditor scan https://jsonplaceholder.typicode.com/users

Output:

🔍 Starting security scan on: https://jsonplaceholder.typicode.com/users

           Security Scan Results
┏━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━┓
┃ Check         ┃ Status        ┃ Severity ┃
┡━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━┩
│ Rate Limiting │ ⚠️ VULNERABLE │ MEDIUM   │
└───────────────┴───────────────┴──────────┘

⚠️ Found 1 vulnerabilities!

2. Test Rate Limiting

api-auditor test-rate-limit https://api.github.com/users/octocat

Output:

🚦 Testing rate limiting on: https://api.github.com/users/octocat

    Rate Limiting Test Results
┏━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┓
┃ Metric                ┃ Value  ┃
┡━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━┩
│ Total Requests        │ 50     │
│ Successful (200)      │ 0      │
│ Rate Limited (429)    │ 50     │
│ Errors                │ 0      │
│ Rate Limiting Present │ ✅ Yes │
└───────────────────────┴────────┘

3. Save Results to File

api-auditor scan https://api.example.com --output report.json --format json
api-auditor report report.json --output final_report.html

📚 Commands Reference

`scan` - Security Scan

Scan a single API endpoint for vulnerabilities.

api-auditor scan URL [OPTIONS]

Options:

Option	Description	Default
`-v, --verbose`	Enable verbose output	False
`-o, --output`	Output file path	None
`-f, --format`	Output format (json/html)	json
`-t, --timeout`	Request timeout in seconds	30

Examples:

# Basic scan
api-auditor scan https://api.example.com/users

# Scan with verbose output
api-auditor scan https://api.example.com/users --verbose

# Save to HTML report
api-auditor scan https://api.example.com/users --output report.html --format html

# Increase timeout for slow APIs
api-auditor scan https://slow-api.com --timeout 60

`test-rate-limit` - Rate Limiting Test

Test if your API implements proper rate limiting.

api-auditor test-rate-limit URL [OPTIONS]

Options:

Option	Description	Default
`-r, --requests`	Number of requests to send	50
`-c, --concurrency`	Concurrent connections	5
`-d, --delay`	Delay between requests (seconds)	0.05

Examples:

# Standard test
api-auditor test-rate-limit https://api.example.com/login

# Aggressive test (100 requests, 10 concurrent)
api-auditor test-rate-limit https://api.example.com/login --requests 100 --concurrency 10

# Slow test (to be polite)
api-auditor test-rate-limit https://api.example.com/login --delay 0.5

`report` - Generate Report

Generate a formatted report from previous scan results.

api-auditor report INPUT_FILE [OPTIONS]

Options:

Option	Description	Default
`-o, --output`	Output file path	None

Examples:

# Generate summary from JSON results
api-auditor report scan_result.json

# Save formatted report
api-auditor report scan_result.json --output formatted_report.json

💡 Examples

Real-World Scenarios

1. Security Audit of Your Production API

# Step 1: Test rate limiting on login endpoint
api-auditor test-rate-limit https://your-api.com/api/login --requests 100 --concurrency 20

# Step 2: Scan user endpoints
api-auditor scan https://your-api.com/api/users --output users_scan.json

# Step 3: Generate report
api-auditor report users_scan.json --output security_report.html

2. Testing Different Environments

# Development
api-auditor scan https://dev-api.example.com --output dev_report.json

# Staging
api-auditor scan https://staging-api.example.com --output staging_report.json

# Production
api-auditor scan https://api.example.com --output prod_report.json

3. Batch Scanning Multiple Endpoints

Create a batch script scan_all.bat:

@echo off
echo Scanning API Endpoints...

api-auditor scan https://api1.example.com --output report1.json
api-auditor scan https://api2.example.com --output report2.json
api-auditor scan https://api3.example.com --output report3.json

echo All scans complete!

4. Testing Public APIs

# GitHub API (has rate limiting)
api-auditor test-rate-limit https://api.github.com/users

# JSONPlaceholder (no rate limiting)
api-auditor scan https://jsonplaceholder.typicode.com/posts

# Agify API (simple demo API)
api-auditor scan https://api.agify.io?name=michael

# Chuck Norris API
api-auditor test-rate-limit https://api.chucknorris.io/jokes/random

🛡️ Security Checks

Check ID	Check Name	Severity	Description
RATE001	Missing Rate Limiting	MEDIUM	API doesn't limit request rates, vulnerable to brute force
HEAD001	Missing Security Headers	LOW	Missing HSTS, CSP, X-Frame-Options headers
DATA001	Sensitive Data Exposure	HIGH	API returns sensitive information in responses
AUTH001	Weak Authentication	HIGH	Weak JWT secrets or missing authentication

🐳 Docker Usage

Pull and Run

# Pull the image
docker pull miladrezanezhad/api-security-auditor-pro:latest

# Run a scan
docker run miladrezanezhad/api-security-auditor-pro scan https://api.example.com

# Save output locally
docker run -v $(pwd)/output:/output miladrezanezhad/api-security-auditor-pro \
  scan https://api.example.com --output /output/report.json

Build Custom Image

# Clone repository
git clone https://github.com/miladrezanezhad/api-security-auditor-pro.git
cd api-security-auditor-pro

# Build image
docker build -t api-auditor:custom .

# Run
docker run api-auditor:custom scan https://api.example.com

🔄 CI/CD Integration

GitHub Actions

name: API Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Install API Auditor
        run: pip install api-security-auditor-pro
      
      - name: Run Security Scan
        run: |
          api-auditor scan https://api.example.com --output security-report.json
      
      - name: Upload Results
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-report.json

GitLab CI

security-scan:
  stage: test
  script:
    - pip install api-security-auditor-pro
    - api-auditor scan https://api.example.com --output report.json
    - api-auditor report report.json
  artifacts:
    paths:
      - report.json
    reports:
      junit: report.xml

Jenkins Pipeline

pipeline {
    agent any
    stages {
        stage('API Security Scan') {
            steps {
                sh 'pip install api-security-auditor-pro'
                sh 'api-auditor scan https://api.example.com --output security-report.json'
            }
        }
    }
    post {
        always {
            archiveArtifacts artifacts: 'security-report.json'
        }
    }
}

📊 Output Formats

JSON Format (Machine-readable)

{
  "target": "https://api.example.com",
  "timestamp": "2026-05-30T05:20:57.186710",
  "vulnerabilities": [
    {
      "check": "Rate Limiting",
      "severity": "MEDIUM",
      "finding": "No rate limiting detected",
      "remediation": "Implement rate limiting to prevent brute force attacks"
    }
  ],
  "scan_summary": {
    "duration_seconds": 2.34,
    "checks_performed": 1
  }
}

Console Table (Human-readable)

           Security Scan Results
┏━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━┓
┃ Check         ┃ Status        ┃ Severity ┃
┡━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━┩
│ Rate Limiting │ ⚠️ VULNERABLE │ MEDIUM   │
└───────────────┴───────────────┴──────────┘

❓ FAQ

Q: What APIs can I test?

A: Any HTTP/HTTPS API - REST, GraphQL, SOAP. Public APIs, internal APIs, microservices.

Q: Will this attack my API?

A: No! It only sends safe test requests. It checks for configurations and behaviors without exploiting vulnerabilities.

Q: How many requests will it send?

A: Default is 30-50 requests per test. You can control this with --requests parameter.

Q: Can I use it behind a corporate proxy?

A: Yes! Set environment variables:

set HTTP_PROXY=http://proxy.company.com:8080
set HTTPS_PROXY=https://proxy.company.com:8080

Q: Does it work with authenticated APIs?

A: Current version supports basic scanning. Future versions will add authentication support.

Q: How accurate are the results?

A: Very accurate for rate limiting detection. Other checks are being continuously improved.

🤝 Contributing

Contributions are welcome! Here's how you can help:

Report Bugs: Open an issue on GitHub
Suggest Features: Tell us what you'd like to see
Submit PRs: Fix bugs or add features
Improve Docs: Help make documentation better

Development Setup

# Clone repository
git clone https://github.com/miladrezanezhad/api-security-auditor-pro.git
cd api-security-auditor-pro

# Create virtual environment
python -m venv venv
source venv/bin/activate  # Windows: venv\Scripts\activate

# Install development dependencies
pip install -e ".[dev]"

# Run tests
pytest

# Run linting
black src tests
flake8 src tests

📄 License

MIT License - see LICENSE file for details.

🙏 Acknowledgments

OWASP for API security guidelines
The Python open-source community
All contributors and users

📞 Support

Issues: GitHub Issues
Discussions: GitHub Discussions
Email: miladvf2014@gmail.com

⭐ Star This Project

If you find this tool useful, please star it on GitHub!

https://github.com/miladrezanezhad/api-security-auditor-pro

Made with ❤️ for API security

🚀 Quick Command Reference Card

# Help
api-auditor --help
api-auditor scan --help

# Scan
api-auditor scan https://api.example.com
api-auditor scan https://api.example.com --verbose
api-auditor scan https://api.example.com --output report.json

# Rate Limit Test
api-auditor test-rate-limit https://api.example.com
api-auditor test-rate-limit https://api.example.com --requests 100 --concurrency 10

# Reports
api-auditor report scan_result.json
api-auditor report scan_result.json --output final.html

Start securing your APIs today! 🎯

Name		Name	Last commit message	Last commit date
Latest commit History 10 Commits
.github/workflows		.github/workflows
src/api_security_auditor_pro		src/api_security_auditor_pro
.gitattributes		.gitattributes
.gitignore		.gitignore
Dockerfile		Dockerfile
README.md		README.md
docker-compose.yml		docker-compose.yml
final_report.json		final_report.json
image.png		image.png
install.bat		install.bat
install.sh		install.sh
pyproject.toml		pyproject.toml
requirements-dev.txt		requirements-dev.txt
requirements-docs.txt		requirements-docs.txt
requirements-test.txt		requirements-test.txt
requirements.txt		requirements.txt
result.json		result.json
scan_result.json		scan_result.json
setup.py		setup.py

Folders and files

Latest commit

History

Repository files navigation

🔒 API Security Auditor Pro

🎯 What is API Security Auditor Pro?

Key Features

📋 Table of Contents

🚀 Installation

From PyPI (Recommended)

From Source

With Docker

🎬 Quick Start

1. Scan an API Endpoint

2. Test Rate Limiting

3. Save Results to File

📚 Commands Reference

scan - Security Scan

test-rate-limit - Rate Limiting Test

report - Generate Report

💡 Examples

Real-World Scenarios

1. Security Audit of Your Production API

2. Testing Different Environments

3. Batch Scanning Multiple Endpoints

4. Testing Public APIs

🛡️ Security Checks

🐳 Docker Usage

Pull and Run

Build Custom Image

🔄 CI/CD Integration

GitHub Actions

GitLab CI

Jenkins Pipeline

📊 Output Formats

JSON Format (Machine-readable)

Console Table (Human-readable)

❓ FAQ

Q: What APIs can I test?

Q: Will this attack my API?

Q: How many requests will it send?

Q: Can I use it behind a corporate proxy?

Q: Does it work with authenticated APIs?

Q: How accurate are the results?

🤝 Contributing

Development Setup

📄 License

🙏 Acknowledgments

📞 Support

⭐ Star This Project

🚀 Quick Command Reference Card

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`scan` - Security Scan

`test-rate-limit` - Rate Limiting Test

`report` - Generate Report