Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Structure an OWASP API Security Testing Framework (ASTF) assessment around an authorized, reproducible test pipeline: define scope, inventory the API, provide realistic credentials and request examples, run the OWASP API Security Top 10 checks, add relevant protocol-specific tests, then review and retest the evidence. ASTF is a dynamic black-box tool, not a source-code analyzer, so a scan based only on unauthenticated automatic discovery can miss protected or undocumented routes.
The OWASP project documentation lists release v2.0.1, Java 21 or later, 16 security test cases, and support for HTML, JSON, SARIF, and XML reports. The framework is an OWASP incubator project under the Apache 2.0 license. Treat these as the project details stated in its current documentation, rather than as a guarantee that every API or vulnerability class will be covered by a scan.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What does ASTF test, and what does it not test?
ASTF automates dynamic checks against the OWASP API Security Top 10 2023. It sends requests to an API and evaluates the responses and behavior; it does not read application source code. That distinction matters: ASTF can test an endpoint only when it can reach and exercise it with the information and access you provide.
OWASP describes the framework as a tool designed to automatically detect API vulnerabilities based on the 2023 Top 10. The official project documentation lists 16 test cases, including the ten Top 10 categories and specialized tests for selected protocols and risks. It also reports 350 passing unit tests. A passing unit-test count describes the project’s own test suite; it is not a measure of how many vulnerabilities a scan will find in your API.
#1 Best Overall
ASTF should therefore be one part of an API security assessment, not the whole assessment. A clean result means the configured scan did not report findings under the conditions it tested. It does not establish that every route, role, business workflow, or input was examined.
How should I define the assessment scope?
Before sending traffic, agree on the target systems, allowed test window, identities, rate limits, and operations that must not be exercised. The goal is to prevent the scanner from reaching an unintended environment or performing a destructive action while still giving it enough access to test the API meaningfully.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Write down the scope so it can be repeated and reviewed. Include the environment and hostnames, the API versions in scope, the expected credentials and roles, the test window, any rate constraints, and any excluded routes or actions. Treat staging and production as distinct targets: permission to test one does not automatically authorize testing the other.
- Target: identify the API host and environment, and confirm which versions or service areas are in scope.
- Authorization: record who approved the assessment and which identities may be used.
- Safety limits: agree on request-rate limits, maintenance windows, and excluded destructive operations.
- Coverage goal: decide whether the scan is a quick discovery pass or a repeatable assessment of a known endpoint inventory.
- Evidence handling: decide where reports, credentials, and request or response details may be stored and who can access them.
ASTF includes checks involving authentication, resource consumption, login and payment-like flows, and potentially sensitive data. Those checks can have operational or account effects. The person authorizing the test should understand the planned coverage and ensure that the identities and test data are appropriate for it.
Which endpoint-discovery approach should I choose?
Choose between automatic discovery, a supplied endpoint list, or a combination based on how complete and repeatable the inventory needs to be. Automatic discovery is useful for an initial pass; a reviewed endpoint file provides a more controlled scope for a serious or recurring assessment.
| Approach | Useful when | Main limitation | Reproducibility |
|---|---|---|---|
| Automatic discovery | You need a first pass to identify reachable routes through documented OpenAPI/Swagger probing and common-path discovery. | It may not expose authenticated, undocumented, or otherwise inaccessible routes, so the resulting inventory can be incomplete. | Less deterministic: what the scanner can discover may depend on the API’s reachable surface and available information. |
| Supplied endpoint file | You have a known route inventory and want to keep the scan’s scope explicit. | It tests only the routes represented in the provided inventory; omissions in that file become coverage gaps. | More deterministic when the file and its version are retained with the assessment. |
| Both | You want to compare a known route list with routes discovery can reach. | Discovery still does not prove that every protected or undocumented route has been found. | Useful for repeatability if you preserve both the supplied inventory and the discovery results. |
The repository documents endpoint-source precedence as: a CLI endpoints file, inline configuration, a configured endpoint file, automatic discovery, and then fallback paths. This ordering is important when a scan uses more than one source: a higher-priority source can determine which endpoint list is used. Check the effective configuration rather than assuming that adding a secondary source merges it with the first.
Recommended Free Tools
Rank #2
For a deterministic scan of routes you have already reviewed, the documented --no-discovery option disables discovery. Preserve the endpoint file used for the scan so another analyst can determine exactly what was in scope. If you instead rely on discovery, document that choice and treat the results as limited to the routes the scanner could reach.
How do I configure identities and realistic requests?
Use credentials that represent the API’s actual access model, and include request bodies that resemble valid application traffic. Authentication is not just a setup detail: without it, the scanner may be unable to reach the routes and behaviors where important authorization and input-handling defects appear.
ASTF documentation lists bearer tokens, API keys, Basic authentication, custom headers, and mutual TLS among its authentication modes. Choose the mode the target actually uses; do not send credentials for a different user or environment by mistake. The project also documents a --secondary-token option for supplying a second identity.
- Select representative accounts. Use test identities whose roles and access rights are understood. For authorization testing, a second user should be distinct from the first, not simply another token for the same account.
- Configure the target’s authentication method. Supply the appropriate token, key, credentials, header, or client-certificate setup for the API under test.
- Provide representative request shapes. Include the kinds of request bodies the endpoint expects. Realistic fields give injection and unsafe-consumption checks useful inputs to exercise.
- Check access before the scan. Confirm that the chosen identity can reach the intended test routes and that the test data is safe to use.
- Record the roles and configuration. Keep a note of which identity was primary, which was secondary, and what permissions each had, without exposing secrets in the report.
For Broken Object Level Authorization (BOLA), two identities let you ask a direct question: can a second user access the exact same object URL that the first user is authorized to use? ASTF describes this as its strongest BOLA evidence because the test does not depend on guessing another object’s identifier. Use an object and account designed for testing, and assess the response in the context of the two users’ intended permissions.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRequest examples should be realistic but safe. A body that omits required fields or uses invalid values may fail before the scanner reaches the behavior you want to assess. Conversely, use test data rather than live customer data wherever possible, particularly when checking excessive data exposure or business-flow protections.
How do ASTF’s API1–API10 checks map to practical risks?
The baseline suite follows the ten OWASP API Security Top 10 2023 categories. Use the category map to plan the identities, routes, and request examples each part of the assessment needs; the category label alone does not tell you whether a particular business rule has been fully tested.
| Category | Risk being assessed | Examples of the documented check focus |
|---|---|---|
| API1: Broken Object Level Authorization | A user may access an object they should not be allowed to read or change. | Object-ID and cross-user authorization checks; a second identity supports an exact-URL access test. |
| API2: Broken Authentication | Authentication or session controls may be bypassed or behave insecurely. | Missing authentication, JWT weaknesses, enumeration, lockout, 2FA bypass, and session-cookie controls. |
| API3: Broken Object Property Level Authorization | Users may receive or modify object properties beyond their permissions. | Excessive data exposure and mass assignment. |
| API4: Unrestricted Resource Consumption | Requests may consume resources without effective limits. | Burst and rate-limit behavior. |
| API5: Broken Function Level Authorization | A user may reach a function or privilege tier they are not authorized to use. | Admin access, HTTP-method escalation, and privilege-tier path substitution. |
| API6: Unrestricted Access to Sensitive Business Flows | Important workflows may be automated or abused without sufficient controls. | Bot protection on login, OTP, payment, and similar flows. |
| API7: Server-Side Request Forgery | An API may make an unsafe server-side request based on user-controlled input. | URL, webhook, and redirect parameters. |
| API8: Security Misconfiguration | Configuration may expose information or weaken protections. | Security headers and verbose error responses. |
| API9: Improper Inventory Management | Old, undocumented, or exposed API surfaces may remain reachable. | Deprecated versions, shadow endpoints, and exposed documentation. |
| API10: Unsafe Consumption of APIs | Data from integrations or other sources may be handled unsafely. | Integration injection and open redirects. |
Use this mapping as a coverage checklist, not as proof that a category has been exhaustively exercised. For example, an endpoint’s presence in the scan does not by itself demonstrate that every role was tested against every object or function. Keep the role and route combinations that were actually exercised in the assessment record.
When should I add ASTF’s specialized tests?
Add specialized tests when the API’s technology or attack surface makes them relevant. ASTF documentation lists dedicated coverage for GraphQL, gRPC endpoint and reflection behavior, mutual TLS validation, LLM prompt injection, SQL/NoSQL injection, and regular-expression denial of service (ReDoS).
- GraphQL: include it when the API exposes a GraphQL interface, rather than assuming ordinary route discovery represents the full interface.
- gRPC: consider the documented endpoint and reflection checks when gRPC services are in scope.
- Mutual TLS: use the mTLS validation checks when client certificates are part of the API’s trust boundary.
- LLM-backed endpoints: include prompt-injection testing if the API accepts or processes prompts through a language-model feature.
- SQL/NoSQL injection: provide representative input-bearing requests for endpoints that process user-controlled values.
- ReDoS: consider the regular-expression denial-of-service test where the application uses regular-expression processing on API inputs.
These are targeted checks, not a reason to enable every test indiscriminately. Confirm that the relevant service is in scope, the request shapes are meaningful, and the test can be run safely under the agreed rate and operational limits.
How do I choose between a quick scan and a complete assessment?
A quick black-box discovery pass is faster to start, while a known endpoint inventory paired with authenticated identities provides stronger, more repeatable coverage. Pick the mode to match the decision you need to make, and state its limits in the report.
| Assessment choice | Endpoint completeness | Authenticated coverage | Cross-user authorization | Request realism | Reproducibility |
|---|---|---|---|---|---|
| Discovery-only, unauthenticated pass | Limited to routes discovery can reach. | Limited; protected routes may not be accessible. | Does not provide a second authenticated user by itself. | Limited if representative request bodies are not supplied. | Lower when the discovered surface changes between runs. |
| Known endpoints with one identity | Controlled by the supplied route inventory. | Can test routes reachable by the configured identity. | Does not establish cross-user access behavior without another identity. | Improved when realistic request shapes are configured. | Higher when the route file and settings are retained. |
| Known endpoints with multiple identities and request examples | Controlled and reviewable, subject to completeness of the inventory. | Tests access available to the configured roles. | Supports exact-object cross-user testing with a distinct second identity. | Best suited to exercising real fields and behaviors. | Higher when identities, endpoint list, configuration, and version are documented. |
OWASP’s ASTF Testing Guidelines caution against relying on pure black-box mode alone. That does not make discovery useless: it can identify reachable routes and provide a first pass. The practical improvement is to pair discovery with a reviewed inventory and authenticated test identities when the assessment needs stronger coverage.
How should I review findings and set a CI gate?
Do not treat a scanner finding as a final security conclusion until an analyst checks its request and response evidence. For pipeline automation, choose a report format suited to the consumer and interpret ASTF’s documented exit codes deliberately.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
The project supports HTML, JSON, SARIF, and XML output. HTML is useful for human review; JSON and XML can feed other processing; SARIF can be sent to GitHub Code Scanning. Retain enough evidence to understand the route, identity, test, and observed behavior without exposing secrets or unnecessary sensitive data.
| Exit code | Documented meaning | Pipeline interpretation |
|---|---|---|
| 0 | No findings. | Allow the next step only if the scan completed as expected and the assessment scope was adequate. |
| 1 | Findings detected. | Apply the agreed finding and severity policy; do not assume every finding has the same release impact. |
| 2 | Scan error. | Treat as a failed assessment, not a clean result. Diagnose the error and rerun after correcting the configuration or execution problem. |
A CI gate needs a policy in addition to an exit code. Decide which findings block a release, who can approve an exception, how findings are tracked, and whether the pipeline distinguishes newly introduced findings from existing ones. ASTF’s documented exit state reports whether findings were detected; the organization must define the severity threshold and release response.
Use GitHub Actions or another automation path only after confirming the workflow has the right target, credentials, endpoint inventory, and report handling. A successful workflow run is not evidence of adequate security coverage if it scanned the wrong environment or could not authenticate to important routes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I make scans repeatable and retest fixes?
Retain the information needed to reproduce the assessment and compare results. A retest is meaningful only if the relevant scope, identity, and input conditions can be understood alongside the original finding.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Record the tool version. The OWASP project page lists v2.0.1; note the actual version used rather than assuming the latest documentation describes an older run.
- Preserve the endpoint inventory. Keep the supplied endpoints file or the discovery configuration and results, as appropriate.
- Document identities and roles. Record the roles tested and whether a second identity was used, without storing reusable credentials in plain-text assessment artifacts.
- Save non-secret configuration. Retain the relevant options and request-shape assumptions so the next run uses comparable inputs.
- Timestamp the run and findings. Record when the scan ran, which environment it targeted, and what it reported.
- Retest the specific behavior. After remediation, rerun the relevant check under the same meaningful conditions and compare the resulting evidence.
Keep limitations alongside the results. In particular, say when a run used automatic discovery only, lacked authenticated access, did not include a second identity, or omitted a relevant protocol-specific test. That context makes a report useful to developers and decision-makers without implying broader coverage than the scan achieved.
What prerequisites and limits should I plan for?
ASTF requires Java 21 or later according to the OWASP repository documentation. The project page lists Apache 2.0 licensing and describes ASTF as an OWASP incubator project; confirm the current project documentation when planning an installation or a versioned assessment.
The framework’s documented capabilities do not remove the need for authorization, safe test data, manual review, or other security practices. Its dynamic approach tests what it can reach and exercise, so missing endpoints, unavailable roles, unrealistic inputs, and untested business logic remain important limitations.
- Do not interpret a clean scan as proof that the API is secure.
- Do not treat an unauthenticated discovery run as a substitute for authenticated role testing.
- Do not use a second token as a proxy for cross-user testing unless it truly represents a different user with relevant permissions.
- Do not interpret an exit code of 2 as a successful scan with no findings.
- Do not test out-of-scope hosts, accounts, or destructive operations simply because discovery finds them.
Frequently Asked Questions
Can ASTF test an API without its source code?
Yes. ASTF is a dynamic black-box testing tool and does not read application source code. It still needs a reachable target and enough endpoint, authentication, and request information to exercise the behaviors in scope.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does ASTF replace a penetration test?
No single automated scan establishes that an API is secure. Manual review and testing are still needed for business rules, routes or roles the scan could not reach, and findings whose impact depends on application context.
Can I run ASTF against a production API?
Only with explicit authorization and an agreed safety plan. Define rate limits, testing windows, test identities, and excluded operations with the API owner before sending assessment traffic.
What should I do if ASTF exits with code 2?
Treat it as a scan error, not a no-findings result. Check the run’s configuration and execution logs, correct the underlying issue, and rerun before using the scan as a release decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
