OWASP API Security Testing Framework (ASTF)

The OWASP API Security Testing Framework (ASTF) is an open-source, automated security testing tool built to detect vulnerabilities in application programming interfaces (APIs). Designed to evaluate endpoints against the OWASP API Security Top 10 2023, the framework bridges the gap between web vulnerability scanners and specialized API logic testing.

1. What is OWASP ASTF?

ASTF operates as a black-box security scanning engine. Powered by Java 21 virtual threads for high-concurrency execution, it allows security teams, developers, and QA engineers to automatically discover API endpoints and evaluate them for authorization failures, authentication bypasses, injection flaws, and logic bugs.

The framework has been validated against real, intentionally vulnerable target environments—including OWASP crAPI, VAmPI, and DVGA—confirming exploitable flaws like cross-user account takeovers and privilege escalations in live testbeds.

2. Core Features & Capability Overview

• Zero-Config Auto-Discovery: ASTF automatically locates endpoints by parsing OpenAPI/Swagger specifications (`/swagger.json`, `/api-docs`, `/openapi.json`), probing common REST path conventions, and traversing versioned API prefixes (`/api/v1/`, `/api/v2/`).
• Cross-User Authorization Testing: To detect Broken Object Level Authorization (BOLA/IDOR), ASTF accepts a secondary authentication token. It tests whether user Identity B can access or manipulate resources at identical URLs belonging to Identity A—providing evidence of cross-user authorization flaws.
• Diverse Authentication Modes: Supports Bearer tokens, API keys, Basic Auth, custom headers, and client certificates for Mutual TLS (mTLS) testing.
• CI/CD & Developer Friendly: Produces reports in HTML (human review), JSON (data processing), SARIF (GitHub Code Scanning integration), and XML.

3. Test Case Catalog (16 Security Modules)

ASTF covers 100% of the OWASP API Security Top 10 2023 along with specialized protocol and AI checks:

• `ASTF-API1-2023`: Broken Object Level Authorization (BOLA) – Manipulates path parameters/UUIDs and verifies cross-user data access via dual tokens.
• `ASTF-API2-2023`: Broken Authentication – Checks for missing auth, JWT `none` algorithm acceptance, and weak token signatures.
• `ASTF-API3-2023`: Broken Object Property Level Authorization – Checks for mass assignment and excessive data exposure in payloads/responses.
• `ASTF-API4-2023`: Unrestricted Resource Consumption – Tests rate limiting, payload size limits, and ReDoS vector exposure.
• `ASTF-API5-2023` :Broken Function Level Authorization Tests – HTTP method escalation and administrative path substitution (`/user` $\rightarrow$ `/admin`).
• `ASTF-API6-2023`: Unrestricted Access to Sensitive Business Flows – Identifies unthrottled execution of critical business logic endpoints.
• `ASTF-API7-2023`: Server-Side Request Forgery (SSRF) – Injects external callbacks into URI/URL parameters.
• `ASTF-API8-2023`: Security Misconfiguration – Checks CORS wildcards, verbose error stack traces, and insecure HTTP headers.
• `ASTF-API9-2023`: Improper Inventory Management – Probes for exposed debug endpoints, deprecated API versions, and unlinked endpoints.
• `ASTF-API10-2023`: Unsafe Consumption of APIs – Evaluates downstream payload trust and third-party integration sanitization.

Extended Checks GraphQL / gRPC / mTLS / LLM Tests GraphQL introspection, gRPC reflection, client-certificate validation, and LLM prompt injection vectors.

4. Quick Start & Execution

Prerequisites

• Java 21+ (for virtual thread concurrency)
• Pre-built executable executable JAR file

Running a Scan (CLI Example)

Download the pre-built ASTF executable JAR
curl -LO https://github.com/OWASP/www-project-api-security-testing-framework/releases/latest/download/astf-v2.0.1.jar

Run scan with inline parameters and output a HTML report
java -jar astf-v2.0.1.jar \
-u https://api.example.com \
--token "YOUR_BEARER_TOKEN" \
--secondary-token "SECOND_USER_BEARER_TOKEN" \
-f HTML -o security-report.html -v

YAML Configuration File (`scan-config.yaml`)

target:
url: "https://api.example.com"
auth:
bearerToken: "PRIMARY_USER_JWT"
secondaryBearerToken: "SECONDARY_USER_JWT_FOR_BOLA_TESTING"
output:
format: "SARIF"
file: "results.sarif"
verbose: true

Download Owasp API Security Testing Framework (ASTF)