OWASP Noir: Open-source static analysis tool
OWASP Noir statically inventories API endpoints across 29 languages and 205 frameworks, surfacing shadow APIs and hardcoded secrets for reviewers and DAST tools.
OWASP Noir is a free open-source static analysis tool that enumerates an application's endpoints (paths, HTTP methods, parameters, headers, cookies) with file and line references. It covers 29 languages and 205 frameworks from a single binary, runs passive rules flagging hardcoded keys and credentials, and tags endpoints with 17 labels like jwt, payment, and admin. Results export to 22 formats including SARIF, OpenAPI, and Postman, can feed ZAP, Burp Suite, Caido, and Gori, and it ships as a GitHub Action with optional LLM-assisted analysis via OpenAI or Ollama.
- Static analysis inventories endpoints across 29 languages and 205 frameworks
- Detects shadow APIs, deprecated routes, hardcoded keys and credentials
- Exports to 22 formats including SARIF, OpenAPI, Postman
- Feeds routes to ZAP, Burp Suite, Caido; ships as GitHub Action
From the original article
2 min read at helpnetsecurity.com
OWASP Noir is an open-source static analysis tool that reads an application’s source code and lists the endpoints it exposes: paths, HTTP methods, parameters, headers, and cookies, each tied to the file and line it came from. Here’s where it gets useful.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.