- Home
- API Security Testing Software
- Automatic API Attack Tool
Automatic API Attack Tool
What it is
Automatic API Attack Tool generates and runs tests from an API specification, using values that either follow or violate the specification’s defined boundaries. Its supported scenarios include requests with generated valid values and requests that introduce a random invalid value into each checked parameter. The required input is a Swagger 2.0 specification in JSON or YAML; the tool does not discover APIs. It supports authorization and input-validation testing, and its request generation can be extended for additional attack types, including illegal resource access, XSS, SQL injection, and RFI. Results include request details and checks against expected responses, with a summary, TestNG output under build/testng-results, and bad requests saved in a bad_requests folder. Optional arguments allow requests to pass through a proxy. The project describes use in CI/CD, including a Jenkins job triggered by a schedule or code push. It is self-hosted, runs on Windows and Linux, and requires Java 8 or higher and Gradle. The open-source tool is free under the MIT license.
For and against
For
- Generates valid and invalid parameter scenarios.
- Supports authorization and input-validation testing.
- Optional proxy routing uses host and port arguments.
- Can be extended for additional attack types.
- Reports request checks and saves bad requests.
Against
- Requires Swagger 2.0 in JSON or YAML.
- Requires Java 8 or higher and Gradle.
- Does not discover APIs.
- Requires self-hosted deployment.
The verdict
Automatic API Attack Tool offers specification-driven fuzzing with results organized for review and CI/CD use. Its Swagger 2.0 requirement and local setup prerequisites are important constraints.
Who it suits
It suits teams that want to run specification-based API fuzzing and can manage a self-hosted Java and Gradle setup. It may also fit CI/CD workflows that run through Jenkins.
Plans and prices
MIT-licensed open-source tool
Java 8 or higher · Gradle · Swagger 2.0 API specification
Read 8 Oct 2026 · github.com
On the record
- API format
- The required specification is Swagger 2.0 in JSON or YAML format.github.com · read 8 Oct 2026
- Attack generation
- It creates fuzzing scenarios by sending generated values within and outside the boundaries defined in the API specification.github.com · read 8 Oct 2026
- Attack vectors
- The README says the tool can be extended to run attacks such as illegal resource access, XSS, SQL injection, and RFI.github.com · read 8 Oct 2026
- CI/CD
- The project says it was built with CI/CD in mind and describes running it in a Jenkins job triggered by a schedule or code push.github.com · read 8 Oct 2026
- Extensibility
- The project says its fuzzing and request generation functionality can be extended for specific needs.github.com · read 8 Oct 2026
- Fuzzing
- It creates positive and negative fuzzing scenarios using generated parameter values that follow or violate the API specification.github.com · read 8 Oct 2026
- License
- The repository lists an MIT license.github.com · read 8 Oct 2026
- Limits
- The README says the required API specification must be Swagger 2.0 and recommends precisely defining legitimate response codes for endpoints.github.com · read 8 Oct 2026
- Linux
- The README describes combining a runnable shell script with the JAR to make a Linux executable.github.com · read 8 Oct 2026
- Proxy support
- Optional arguments let users route requests through a proxy by specifying its host and port.github.com · read 8 Oct 2026
- Purpose
- The tool takes an API specification as input and generates and runs attacks based on it.github.com · read 8 Oct 2026
- Reporting
- The tool writes TestNG results under `build/testng-results`, prints check details and a summary, and stores bad requests in a `bad_requests` folder.github.com · read 8 Oct 2026
- Requirements
- Running the tool requires Java 8 or higher and Gradle.github.com · read 8 Oct 2026
- Results
- The tool reports request details and whether responses matched expectations, writes TestNG results under build/testng-results, and stores bad requests in a bad_requests folder.github.com · read 8 Oct 2026
- Specification support
- The required specification is Swagger 2.0 in JSON or YAML format.github.com · read 8 Oct 2026
- Support
- The README directs users to source code documentation and gives an email address for questions; it directs bug reports to GitHub Issues.github.com · read 8 Oct 2026
- Test scenarios
- Supported scenarios include requests with generated valid values and requests that inject a random invalid value into each checked parameter.github.com · read 8 Oct 2026
- Windows
- The README gives `gradlew.bat build` as the Windows build command.github.com · read 8 Oct 2026
