API Pentesting Tools

The most popular API client. Essential for manual testing, organizing collections, and automating requests.

brew install --cask postman

The industry standard web proxy. Use it to intercept, modify, and scan API traffic.

# Download from website

A high-performance API content discovery tool. Excellent for finding hidden endpoints.

brew install kiterunner

HTTP parameter discovery suite. Finds hidden query parameters in API endpoints.

pip3 install arjun

Fast web fuzzer written in Go. Great for directory and endpoint discovery.

go install github.com/ffuf/ffuf@latest

A toolkit for testing, tweaking, and cracking JSON Web Tokens (JWTs).

git clone https://github.com/ticarpi/jwt_tool

Automatic SQL injection and database takeover tool. Works well on API endpoints.

brew install sqlmap

A Burp Suite extension for GraphQL security testing. Introspection, scanner, and more.

# Install via Burp BApp Store

Like curl, but for gRPC. Interact with gRPC servers from the command line.

brew install grpcurl

In-depth attack surface mapping and asset discovery.

brew install amass