Package: offat
OFFAT - OFFensive Api TesterAutomatically Tests for vulnerabilities after generating tests from openapi specification file. Project is in Beta stage, so sometimes it might crash while running.Security ChecksRestricted HTTP MethodsSQLiBOLA (Might need few bug fixes)Data Exposure (Detects Common Data Exposures)BOPLA / Mass AssignmentBroken Access ControlBasic Command InjectionBasic XSS/HTML Injection testBroken AuthenticationFeaturesFew Security Checks from OWASP API Top 10Automated TestingUser Config Based TestingAPI for Automating tests and Integrating Tool with other platforms/toolsCLI toolProxy SupportDockerized Project for Easy UsageOpen Source Tool with MIT LicenseDemoPyPi DownloadsPeriodCountWeeklyMonthyTotalDisclaimerThe disclaimer advises users to use the open-source project for ethical and legitimate purposes only and refrain from using it for any malicious activities. The creators and contributors of the project are not responsible for any illegal activities or damages that may arise from the misuse of the project. Users are solely responsible for their use of the project and should exercise caution and diligence when using it. Any unauthorized or malicious use of the project may result in legal action and other consequences.Read MoreInstallationUsing pipInstall main branch using pippython3-mpipinstallgit+https://github.com/OWASP/OFFAT.gitInstall Release from PyPipython3-mpipinstalloffat# only cli toolpython3-mpipinstalloffat[api]# cli + apiUsing ContainersDockerBuild Imagemakebuild-local-imagesCLI Tooldockerrun--rmdmdhrumilmistry/offatAPIdockercomposeup-dPOSTopenapidocumentation to/api/v1/scan/endpoint with its validtype(json/yaml);job_idwill be returned.Manual MethodOpen terminalInstall git packagesudoaptinstallgitpython3-yInstallPoetryclone the repository to your machinegitclonehttps://github.com/OWASP/OFFAT.gitChange directorycdoffatinstall with poetry# without optionspoetryinstallStart OffATAPIStart API Serverpython-moffat.api# ORoffat-apiAPI Documentation can be found athttp://localhost:8000/docsCLI ToolRun offatoffat-fswagger_file.json# using fileoffat-fhttps://example.com/docs.json# using urlTo get all the commands usehelpoffat-hSave result injson,yamlorhtmlformats.offat-fswagger_file.json-ooutput.json# jsonoffat-fswagger_file.json-ooutput.html-ofhtml# htmloffat-fswagger_file.json-ooutput.yaml-ofyaml# yamljsonformat is default output format.yamlformat needs to be sanitized before usage since it dumps data as python objects.htmlformat needs more visualization.Run tests only for endpoint paths matching regex patternoffat-fswagger_file.json-pr'/user'Add headers to requestsoffat-fswagger_file.json-H'Accept: application/json'-H'Authorization: Bearer YourJWTToken'Run Test with Requests Rate Limitedoffat-fswagger_file.json-rl1000-dr0.001rl: requests rate limit,dr: delay between requestsUse along with proxyoffat-fswagger_file.json-phttp://localhost:8080--no-ssl-ooutput.jsonMake sure that proxy can handle multiple requests at the same timeUse user provided inputs for generating testsoffat-fswagger_file.json-tdctest_data_config.yamltest_data_config.yamlactors:-actor1:request_headers:-name:Authorizationvalue:Bearer [Token1]-name:User-Agentvalue:offat-actor1query:-name:idvalue:145type:int-name:countryvalue:uktype:str-name:cityvalue:londontype:strbody:-name:namevalue:actoronetype:str-name:emailvalue:actorone@example.comtype:str-name:phonevalue:+11233211230type:strunauthorized_endpoints:# For broken access control-"/store/order/.*"-actor2:request_headers:-name:Authorizationvalue:Bearer [Token2]-name:User-Agentvalue:offat-actor2query:-name:idvalue:199type:int-name:countryvalue:uktype:str-name:cityvalue:leedstype:strbody:-name:namevalue:actortwotype:str-name:emailvalue:actortwo@example.comtype:str-name:phonevalue:+41912312311type:strIf you're using Termux or windows, then usepipinstead ofpip3.Few features are only for linux os, hence they might not work on windows and require admin priviliges.Open In Google Cloud ShellTemporary SessionPerisitent SessionHave any Ideas 💡 or issueCreate an issueFork the repo, update script and create a Pull RequestContributingReferCONTRIBUTIONS.mdfor contributing to the project.LICENSEOffat is distributed underMITLicense. ReferLicensefor more information.