Awesome API Security: README

# [awesome-apisec](https://github.com/arainho/awesome-apisec)

<h4 align="center">A collection of awesome API Security tools and resources.</h4>
      
<p align="center">
  <a href="#about">About</a> •
  <a href="#api-keys-find-and-validate">API Keys: Find and validate</a> •
  <a href="#books">Books</a> •
  <a href="#cheatsheets">Cheatsheets</a> •
  <a href="#checklist">Checklist</a> •
  <a href="#conferences">Conferences</a> • </br>
  <a href="#deliberately-vulnerable-apis">Deliberately vulnerable APIs</a> •
  <a href="#design-architecture-development">Design, Architecture, Development</a> •
  <a href="#encyclopedias-projects-wikis-and-gitbooks">Encyclopedias, Projects, Wikis and GitBooks</a> • </br>
  <a href="#enumeration-scanning-and-exploration-steps">Enumeration, Scanning and exploration steps</a> •
  <a href="#firewalls">Firewalls</a> •
  <a href="#fuzzing-seclists-wordlists">Fuzzing, SecLists, Wordlists</a> •
  <a href="#http-101">HTTP 101</a> •
  <a href="#mind-maps">Mind maps</a> • </br>
  <a href="#newsletters">Newsletters</a> • 
  <a href="#other-resources">Other resources</a> • 
  <a href="#playlists">Playlists</a> •
  <a href="#podcasts">Podcasts</a> •
  <a href="#presentations-videos">Presentations, Videos</a> •
  <a href="#projects">Projects</a> • </br>
  <a href="#security-apis">Security APIs</a> •
  <a href="#specifications">Specifications</a> •
  <a href="#tools">Tools</a> •
  <a href="#training-workshops-labs">Training, Workshops, Labs</a> •
  <a href="#twitter">Twitter</a> •
  </br>
  • <a href="#contributions">Contributions</a> •
</p>

---

## About
The awesome-api-security (aka awesome-apisec) repository is collection of awesome API Security tools and resources.     
The focus goes to open-source tools and resources that benefit all the community.    

Please read the <a href="#contributions">contributions</a> section before opening a pull request.

## API Keys: Find and validate
| Name | Description |
| ---- | ----------- |
| [API Guesser](https://api-guesser.netlify.app/) | Simple website to guess API Key / OAuth Token by Muhammad Daffa |
| [API Key Leaks: Tools and exploits](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/API%20Key%20Leaks) | An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares. |
| [Key-Checker](https://github.com/daffainfo/Key-Checker)| Go scripts for checking API key / access token validity. |
| [Keyhacks](https://github.com/streaak/keyhacks)| Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid. |
| [Private key usage verification ](https://github.com/trufflesecurity/driftwood) | Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user. |
| [Mantra](https://github.com/MrEmpy/mantra) | A tool used to hunt down API key leaks in JS files and pages |

## Books
| Author      | Publisher | Name | Description |
| ----------- | --------- | -----| ----------- |
| Colin Domoney | Packt Publishing | [Defending APIs](https://www.packtpub.com/product/defending-apis/[PII_REDACTED]120) | Focused on helping developers produce secure APIs |
| Confidence Staveley | Packt Publishing | [API Security for White Hat Hackers](https://www.packtpub.com/en-us/product/api-security-for-white-hat-hackers[PII_REDACTED]802) | Uncover offensive defense strategies and get up to speed with secure API implementation |
| Corey Ball  | No Starch Press | [Hacking APIs](https://nostarch.com/hacking-apis)| Breaking Web Application Programming Interfaces. |
| Dolev Farhi and Nick Aleks | No Starch Press | [Black Hat GraphQL](https://nostarch.com/black-hat-graphql) | Black Hat GraphQL. |
| Emily Freeman | Data Theorem Special Edition | [API Security for dummies](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWJ9kN) | This book is a high-level introduction to the key concepts of API security and DevSecOps. |
| Justing Richer and Antonio Sanso | Manning | [Understanding API Security](https://livebook.manning.com/book/understanding-api-security/introduction/) | Several chapters from several Manning books that give you some context for how API security works in the real world. |
| Neil Madden | Manning   | [API Security in Action](https://www.manning.com/books/api-security-in-action)| API Security in Action teaches you how to create secure APIs for any situation. |
| José Haro Peralta | Manning   | [Secure APIs: Design, build, and implement](https://www.manning.com/books/secure-apis)| Practical, battle-tested techniques to recognize and prevent attacks on your APIs. |


## Cheatsheets
| Name | Description |
| ---- | ----------- |
| [GraphQL Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html) | GraphQL - OWASP Cheat Sheet Series |
| [JSON Web Token Security Cheat Sheet](https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_security_cheatsheet.pdf) | PentesterLab - JSON Web Token Security Cheat Sheet |
| [Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html) | Injection - OWASP Cheat Sheet Series
| [Microservices Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Microservices_Security_Cheat_Sheet.html) | Microservices - OWASP Security Cheat Sheet |
| [OWASP API Security Top 10](https://apisecurity.io/encyclopedia/content/owasp-api-security-top-10-cheat-sheet-a4.pdf) | 42Crunch - OWASP API Security Top 10 |
| [REST Assessment Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Assessment_Cheat_Sheet.html) | REST Assessment - OWASP Cheat Sheet Series |
| [REST Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html) | REST Security - OWASP Cheat Sheet Series |

## Checklist
| Author  | Name | Description |
| ------- | ---- | ------------|
| HolyBugx | [another API Security checklist](https://github.com/HolyBugx/HolyTips/blob/main/Checklist/API%20Security.pdf) | HolyTips: API security checklist
| APIOps Cycles | [API audit checklist](https://www.apiopscycles.com/api-audit-checklist) | API Audit checklist. |
| Shieldfy | [API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist) | Checklist of the most important security countermeasures when designing, testing, and releasing your API. |
| API Mike, @api_sec | [API penetration testing checklist](https://apimike.com/api-penetration-testing-checklist) | Common steps to include in any API penetration testing process. |
|  Latish Danawale  |  [API Testing Checklist](https://hackanythingfor.blogspot.com/2020/07/api-testing-checklist.html) | API Testing Checklist. |
| Inon Shkedy | [31 days of API Security Tips](https://github.com/smodnix/31-days-of-API-Security-Tips) | This challenge is Inon Shkedy's 31 days API Security Tips. |
| Binary Brothe