OWASP Noir
An AI-powered tool that analyzes source code to discover every endpoint, exposing shadow APIs and mapping the complete attack surface for security testing.
What is OWASP Noir?
OWASP Noir is an open-source security tool that analyzes application source code to discover every endpoint, exposing shadow APIs and mapping the complete attack surface. It bridges the gap between SAST and DAST by generating accurate endpoint inventories that enable more comprehensive dynamic security testing. The tool helps security teams eliminate blind spots by detecting hidden routes and deprecated endpoints that traditional methods often miss.
White-box security teams, penetration testers, and DevSecOps engineers who need to identify security blind spots and integrate endpoint discovery into their security pipelines. It's particularly valuable for organizations running dynamic application security testing (DAST) who want more accurate and complete scanning coverage.
Developers choose Noir because it uses AI-powered analysis to detect endpoints in any language or framework, provides a single source of truth for attack surface inventory, and seamlessly integrates with existing DAST tools. Its ability to bypass outdated documentation and proxies by analyzing source code directly makes it uniquely effective at finding what other security tools miss.
Overview
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Use Cases
Best For
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.