Table of Contents

API Security Scanner

Backend
Frontend
Infrastructure

Features

Security Scanners
Core Capabilities

Architecture
Quick Start
Configuration
Scanner Usage

SQLi Scanner
IDOR Scanner
Auth Scanner
Rate Limit Scanner

API Endpoints
Development
Source Code

API Security Scanner

Enterprise-grade automated API security scanner for vulnerability assessment across REST, GraphQL, and SOAP endpoints.

Overview

A full-stack security testing tool that performs deep vulnerability assessment, detecting OWASP API Top 10 flaws through intelligent fuzzing, authentication bypass testing, and comprehensive reporting.

Status: Complete | Difficulty: Intermediate

Tech Stack

Backend

Technology	Version	Purpose
FastAPI	0.121+	Async Python web framework
PostgreSQL	16	Primary database
SQLAlchemy	2.0+	Async ORM
Alembic	1.17+	Database migrations
JWT (python-jose)	-	Authentication
slowapi	-	Rate limiting
httpx/aiohttp	-	Async HTTP clients

Frontend

Technology	Version	Purpose
React	19.1	UI framework
TypeScript	5.8	Type safety
Vite	7.1	Build tool
TanStack Query	v5	Server state management
Zustand	5.0	Client state
Radix UI	-	Accessible components
Recharts	3.1	Data visualization
Socket.io	4.8	Real-time updates

Infrastructure

Docker + Docker Compose
Nginx reverse proxy
Makefile automation

Features

Security Scanners

Scanner	Description
SQLi Scanner	SQL injection detection with multiple payload types
IDOR Scanner	Insecure Direct Object Reference testing
Auth Scanner	Authentication bypass and weakness detection
Rate Limit Scanner	API rate limiting analysis

Core Capabilities

Configurable scanning parameters (max requests, timeouts, retries)
Rate limiting for scanner requests and API endpoints
JWT-based authentication with token expiration
Real-time scan results via WebSocket
Database persistence for scan configs and results
Extensible payload library

Architecture

┌─────────────────────────────────────────────────────────┐
│                      Frontend (React)                    │
│  ┌─────────┐  ┌──────────┐  ┌─────────┐  ┌───────────┐ │
│  │ Scanner │  │ Results  │  │ History │  │ Dashboard │ │
│  │  Forms  │  │  View    │  │  View   │  │   Charts  │ │
│  └────┬────┘  └────┬─────┘  └────┬────┘  └─────┬─────┘ │
└───────┼────────────┼─────────────┼─────────────┼───────┘
        │            │             │             │
        ▼            ▼             ▼             ▼
┌─────────────────────────────────────────────────────────┐
│                    API Gateway (Nginx)                   │
└─────────────────────────┬───────────────────────────────┘
                          │
┌─────────────────────────▼───────────────────────────────┐
│                   Backend (FastAPI)                      │
│  ┌──────────────────────────────────────────────────┐   │
│  │                     Routes                        │   │
│  │  /auth  /scans  /results  /config  /ws           │   │
│  └──────────────────────┬───────────────────────────┘   │
│                         │                                │
│  ┌──────────────────────▼───────────────────────────┐   │
│  │                    Services                       │   │
│  │  AuthService  ScanService  ResultService         │   │
│  └──────────────────────┬───────────────────────────┘   │
│                         │                                │
│  ┌──────────────────────▼───────────────────────────┐   │
│  │                    Scanners                       │   │
│  │  ┌─────────┐ ┌──────┐ ┌──────┐ ┌────────────┐   │   │
│  │  │  SQLi   │ │ IDOR │ │ Auth │ │ Rate Limit │   │   │
│  │  └─────────┘ └──────┘ └──────┘ └────────────┘   │   │
│  │              BaseScanner + Payloads              │   │
│  └──────────────────────────────────────────────────┘   │
└─────────────────────────┬───────────────────────────────┘
                          │
┌─────────────────────────▼───────────────────────────────┐
│                    PostgreSQL                            │
│  Users | Scans | Results | Configs | Payloads           │
└─────────────────────────────────────────────────────────┘

Quick Start

cd PROJECTS/intermediate/api-security-scanner

# Copy environment file
cp .env.example .env

# Start development environment
make dev

# Access at http://localhost:3000

Configuration

Key environment variables (see .env.example):

# Database
DATABASE_URL=postgresql+asyncpg://user:pass@localhost:5432/scanner

# JWT
JWT_SECRET_KEY=your-secret-key
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30

# Scanner Settings
MAX_CONCURRENT_REQUESTS=10
REQUEST_TIMEOUT=30
MAX_RETRIES=3

Scanner Usage

SQLi Scanner

Tests endpoints for SQL injection vulnerabilities using:

Error-based injection
Union-based injection
Blind injection (boolean and time-based)

IDOR Scanner

Tests for Insecure Direct Object References:

Sequential ID enumeration
UUID prediction
Parameter tampering

Auth Scanner

Tests authentication mechanisms:

Default credentials
Token manipulation
Session handling

Rate Limit Scanner

Analyzes API rate limiting:

Request flooding
Bypass techniques
Threshold detection

API Endpoints

Method	Endpoint	Description
POST	`/auth/register`	User registration
POST	`/auth/login`	JWT authentication
POST	`/scans`	Create new scan
GET	`/scans/{id}`	Get scan status
GET	`/scans/{id}/results`	Get scan results
WS	`/ws`	Real-time updates

Development

# Run linters
make lint

# Run type checking
make typecheck

# Run tests
make test

# Format code
make format