vamp-api-probe

Overview

vamp-api-probe is a DAST (Dynamic Application Security Testing) scanner for modern REST APIs, aligned with the OWASP API Security Top 10 2023. It probes live API endpoints for broken object-level authorization (BOLA), broken function-level authorization (BFLA), mass assignment vulnerabilities, absent rate limiting, authentication weaknesses, exposed administrative endpoints, security header misconfigurations, and legacy version exposure. It can operate against a bare base URL with automatic endpoint discovery or drive its test suite from an OpenAPI/Swagger specification for complete endpoint coverage.

Features

• API1 — BOLA (Broken Object Level Authorization): enumerates numeric path parameters (±1, ±10, ±100, and common IDs), compares authenticated vs unauthenticated responses to detect cross-user data leakage (CRITICAL/HIGH)
• API2 — BFLA (Broken Function Level Authorization): probes every endpoint without Authorization header and tests privileged HTTP methods (DELETE, PUT, PATCH) for missing access control (CRITICAL/HIGH)
• API3 — Mass Assignment: injects admin-escalation fields (isAdmin, role, is_superuser, verified, balance, credits) in POST/PUT/PATCH bodies and checks whether the API accepts them (CRITICAL)
• API4 — Rate Limiting: fires a configurable burst of requests against the same endpoint and flags absence of HTTP 429 responses (HIGH)
• API5 — Broken Authentication: tests manipulated JWT tokens (single-character mutation) and expired JWT detection to identify missing token validation (CRITICAL)
• API6 — Sensitive Business Flows: detects administrative and debug endpoints (/admin, /internal, /debug, /actuator, /metrics, /env, /_debug) accessible without authentication (HIGH)
• API8 — Security Misconfiguration: audits response headers (X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, Content-Security-Policy) and checks for stack trace exposure via malformed input (MEDIUM)
• API9 — Improper Inventory Management: probes legacy API versions (e.g. /v1/ when target is /v2/) for unretired endpoints (MEDIUM)
• OpenAPI/Swagger spec ingestion (YAML or JSON) for automatic endpoint and schema discovery
• Fallback endpoint discovery against common REST paths when no spec is provided
• Bearer token support for authenticated test passes
• Configurable per-request timeout and rate-limit burst size
• Export to Console (Rich), JSON, and HTML (dark-theme)
• VSL unified client report (HTML + optional PDF via fpdf2)

Requirements

• Python 3.9 or later
• rich >= 13.7.0
• aiohttp >= 3.8.0
• pyyaml >= 6.0
• Optional: fpdf2 >= 2.7 for --report-pdf

Installation

pip install vamp-api-probe
# o con Homebrew:
brew install vampsecure-labs/labs/vamp-api-probe

git clone https://github.com/Vampsecure-Labs/vamp-api-probe.git
cd vamp-api-probe
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

vamp-api-probe scan --help

usage: vamp-api-probe scan --url URL
                            [--spec OPENAPI_FILE]
                            [--token BEARER_TOKEN]
                            [--no-auth-tests]
                            [--timeout SECONDS]
                            [--rate-limit-burst N]
                            [--json FILE] [--html FILE]
                            [--client CLIENT] [--engagement ENGAGEMENT]
                            [--auditor AUDITOR] [--report-scope SCOPE]
                            [--report-html FILE] [--report-pdf FILE]

vamp-api-probe — REST API DAST Scanner (VampSecure Labs)

Examples

# Scan a public API with automatic endpoint discovery
vamp-api-probe scan --url https://api.ejemplo.com/v1

# Scan with an OpenAPI spec for full endpoint coverage
vamp-api-probe scan --url https://api.ejemplo.com/v1 --spec openapi.yaml

# Authenticated scan with a Bearer token
vamp-api-probe scan --url https://api.ejemplo.com/v1 --token eyJhbGciOiJIUzI1NiJ9...

# Skip tests that require a second user account
vamp-api-probe scan --url https://api.ejemplo.com/v1 --no-auth-tests

# Custom timeout and rate-limit burst
vamp-api-probe scan --url https://api.ejemplo.com/v1 --timeout 15 --rate-limit-burst 30

# Export findings to JSON and dark-theme HTML
vamp-api-probe scan --url https://api.ejemplo.com/v1 --json results.json --html report.html

# Generate client-ready engagement report (HTML + PDF)
vamp-api-probe scan --url https://api.ejemplo.com/v1 \
    --client "Acme Corp" --engagement "API Security Assessment Q4 2026" \
    --auditor "J. Smith" --report-html client_report.html --report-pdf client_report.pdf

CLI Reference

Output Formats

OWASP API Top 10 Coverage

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-api-probe is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/belky-me
• Orchestrator: github.com/belky-me/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division

Versión

v1.0 — VampSecure Labs Security Research Division