Web and API testing
4 tools. Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/web-api-testing/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| Webapp Testing ChecklistDraft · awaiting review Agent skill that walks an authorized web application test through the OWASP WSTG checklist and writes a findings report. Skill · AccessITGroup, pushed 2026-09-03 | Inside your AI client Works with: Claude Code Needs: Claude Code, with the skill installed from the AITG-hub marketplace or directly; Written authorization to test the specific target, such as a signed SOW or pentest agreement; +5 more | Target web application | changes, sends data out | Code shows: adds autostart, users or keys · writes outside the project · runs shell commands or eval · +2 more Not run yet |
| hackingBuddyGPTDraft · awaiting review Open-source framework for building LLM-driven security-testing agents, with use cases for Linux privilege escalation and web API testing. Agent · ipa-lab, pushed 2026-10-01 | Program you start Works with: Standalone (own model access) Needs: Python 3.13 or newer; An LLM provider API key (litellm format), default endpoint OpenRouter; +3 more | OpenRouter / litellm-reachable LLM provider, SSH target, HTTP target host, Windows psexec target, intercepting proxy (Burp/mitmproxy), OpenAI embeddings, OpenRouter / Anthropic | changes, deletes, runs commands, sends data out | Code shows: writes outside the project · talks to any host · runs shell commands or eval · +3 more Not run yet |
| ShannonDraft · awaiting review Autonomous white-box AI penetration tester for web apps and APIs; reports only vulnerabilities it proves by exploitation. Agent · KeygraphHQ, pushed 2026-10-15 | Container Works with: Standalone (own model access) Needs: Docker is required for the worker container; Node.js 18+ for the npx workflow; +4 more | Model provider, Target URL, Docker Hub, pi model catalogue, Anthropic / OpenAI, Anthropic | changes, runs commands | Code shows: bypasses approval · writes outside the project · talks to any host · +2 more Not run yet |
| StrixDraft · awaiting review Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept. Agent · usestrix, pushed 2026-10-18 | Program you start Works with: Standalone (own model access) Needs: Docker installed and running to host the sandbox container; An LLM API key from a supported provider (OpenAI, Anthropic, Google, etc.); +1 more | LLM provider, targets you name, PostHog, Scarf, Perplexity, PyPI, Strix Cloud (app.strix.ai), ghcr.io | changes, runs commands, sends data out | Code shows: can tunnel or exfiltrate · uses sudo or the docker socket · adds autostart, users or keys · +3 more Not run yet |