Automatic API Attack Tool

Automatic API Attack Tool is a self-hosted utility for generating API security test requests from a specification. It suits developers and teams comfortable building Java projects who want focused checks of input handling and authorization.

Overview

The tool turns an API contract into positive and negative fuzzing scenarios: it sends generated values that follow the specification as well as values designed to violate its boundaries. That makes it useful for checking whether endpoints handle expected and malformed inputs appropriately. It does not discover APIs, so teams need a Swagger 2.0 specification ready before testing can begin.

It can run in a Jenkins job triggered by a schedule or code push, and optional host and port arguments let users route requests through a proxy. This suits teams adding repeatable checks to an existing workflow, but the project must be built and run by the team: it requires Java 8 or higher and Gradle.

Key features

Contract-based fuzzing

The required API specification is Swagger 2.0 in JSON or YAML. The supported scenarios include requests populated with generated valid values and requests that inject a random invalid value into each checked parameter. This is a focused way to probe input validation against a declared contract; it is not a fit for APIs described only in another format.

Extensible attack coverage

The project says its fuzzing and request-generation functions can be extended for specific needs, including attacks such as illegal resource access, XSS, SQL injection, and RFI. That flexibility can help teams adapt the tool to their own checks, but extending coverage requires technical work rather than selecting a ready-made service feature.

Results and workflow

The tool prints request checks and a summary, records whether responses matched expectations, writes TestNG results under build/testng-results, and saves bad requests in a bad_requests folder. These outputs give teams artifacts to review after a run or incorporate into their process. The project recommends defining legitimate response codes precisely for each endpoint; loose expectations can make response checks less useful.

Windows build instructions use gradlew.bat build. On Linux, the project describes packaging a runnable shell script with the JAR to create an executable. The repository uses the MIT license, and support is directed to source documentation and an email address, with bug reports handled through GitHub Issues.

Pricing

MIT-licensed open-source tool: free. The plan includes the tool, with Java 8 or higher, Gradle, and a Swagger 2.0 API specification as requirements. There are no paid tiers or seat and usage caps in the stated plan; the trade-off is that teams supply the build, execution environment, and any extensions themselves.

Platforms

Automatic API Attack Tool supports Linux and Windows, with build guidance for both. It is self-hosted, so users run it in their own environment rather than using a hosted deployment. Its supported API formats are Swagger 2.0 in JSON or YAML.

Who it's for

This is best for developers and security teams with a Swagger 2.0 contract who want free, repeatable input-validation and authorization testing inside a self-managed workflow. It is less suitable for teams that need API discovery, broad specification compatibility, or a managed setup that avoids Java and Gradle maintenance.

Pros and cons

• Pros: Free and MIT-licensed, with no per-seat price stated.
• Pros: Generates positive and negative cases from declared parameter constraints, directly supporting input-validation checks.
• Pros: Jenkins workflow support, proxy options, and stored TestNG results can fit an existing test process.
• Cons: Requires Swagger 2.0, excluding APIs without that specification.
• Cons: Java 8 or higher and Gradle, plus self-hosted execution, put setup and upkeep on the user.
• Cons: No API discovery; teams must bring a suitable specification.

Alternatives

For a wider set of API security options, compare the API Security Testing Software category.

• 42Crunch API Security Platform is worth considering for teams seeking a paid platform with a free plan and trial, plus an AI coding plugin, OpenAPI audit, vulnerability scans, and automatic fixes.
• OWASP Amass is another free, open-source option for teams looking for an Apache License 2.0 framework across Linux, macOS, Windows, and self-hosted environments.
• APISec Platform may suit teams wanting a freemium option with a free plan for public API testing, basic test simulations, and community support.
• VulnAPI is a free MIT-licensed alternative for educational and testing use across Linux, macOS, Windows, and self-hosted environments.
• WuppieFuzz is a free, open-source REST API fuzzer for teams comparing other self-hosted fuzzing options.
• AquilaX API Security Scanner has a free plan covering secrets scanning, PII detection, compliance auditing, unlimited scans, and CI/CD and IDE integration.
• Pynt offers a free Starter plan with limited API security testing for up to 10 API endpoints; its Business plan has custom pricing and full API security testing.
• Schemathesis is a free, open-source API testing tool that generates tests from OpenAPI and GraphQL schemas, making it a relevant alternative when those schema formats are preferred.

Verdict

Choose Automatic API Attack Tool if you have a Swagger 2.0 API, can manage a Java and Gradle build, and want free specification-driven fuzzing in a self-hosted workflow. Its main advantage is focused positive and negative testing without a license fee; look elsewhere if you need API discovery, a different specification format, or a managed platform.