LOCAL · CLI FIRST · OFFLINE

API security testing
from your terminal

Scan endpoints, exploit BOLA, inject SQLi, fuzz params, attack JWT tokens, test GraphQL and SOAP — all from one tool, all local, no accounts required.

Get started View all commands
$ git clone https://github.com/dmitriousben/papister
papister — bash
$ python cli.py browser https://api.target.com --name "recon"
Launching browser → /usr/bin/chromium
Session ID → 7 | Proxy → 127.0.0.1:8787
── Live Traffic ─────────────────────────────────
GET /api/v2/users/1042 [BOLA]
POST /api/v2/orders [TOKEN]
GET /api/v2/users/1043 [BOLA][NEW]
── Session complete ─────────────────────────────
Endpoints: 14 BOLA: 6 Tokens: 2
⚔ Attack menu → Auth: ACTIVE
[1] BOLA [2] SQLi [3] Fuzz [4] JWT ...
→ 1BOLA: HIGH confidence on /users/1043 ✓
12
attack modules
5
auth types
12
vault providers
0
external accounts
What it does

Everything you need in one place

No cloud, no accounts, no data leaving your machine. One CLI, every attack surface.

🔓
BOLA / IDOR
Detect broken object level authorization — the #1 API vulnerability. Mutates IDs in path, query, and body. Sequential, UUID, cross-account, admin ID strategies.
OWASP #1 6 strategies
💉
SQL injection
Deep SQLi across four techniques: error-based, boolean-blind, time-based, and stacked queries. Level 1–3 lets you control depth.
error blind time-based stacked
🌐
Browser mode
Launch Chromium through Papister's proxy, capture all API traffic live, auto-extract tokens and cookies, then fire any attack — no copy-pasting, no switching tools.
session capture auto auth
🔑
JWT attacks
alg:none bypass, claim tampering, kid injection, secret brute-force. Works on any endpoint that accepts Bearer tokens.
alg:none kid inject brute-force
📡
GraphQL & SOAP
GraphQL introspection, batching attacks, deep nesting, alias abuse. SOAP WSDL discovery, XXE injection, SOAPAction spoofing.
introspect XXE batching
🔐
Encrypted vault
AES-256-GCM key storage. 12 provider schemas — Mpesa, Stripe, Binance, AWS, and more. Keyfile + passphrase two-layer protection. Nothing leaves your machine.
AES-256-GCM 12 providers
Commands

Everything runs from one CLI

Thin Typer entry point. Every command delegates cleanly to its module.

Core
Security
Browser
Auth & Vault
Proxy
papister scan <file>
Scan all endpoints from a collection file. Prints live results and writes JSON + HTML reports.
python cli.py scan endpoints.yaml
python cli.py scan endpoints.txt --mode P
papister test <url>
Test a single endpoint. Shows full result inline with status, headers, and timing.
python cli.py test https://api.example.com/v1/users
python cli.py test https://api.example.com/login --method POST
papister fingerprint <url>
Detect backend stack — web server, framework, language, cloud provider. Cross-refs against local CVE DB.
python cli.py fingerprint https://api.example.com
papister headers <url>
Audit security headers — HSTS, CSP, CORS, X-Frame-Options. Returns a security score 0–100.
python cli.py headers https://api.example.com
papister report [timestamp]
Open an HTML report in the browser. No argument opens the latest report.
python cli.py report
python cli.py report 20240601_143022
papister cve update / check
Pull the latest NVD CVE feed, or check a specific technology and version against the local DB.
python cli.py cve update
python cli.py cve check nginx 1.18.0
papister bola <url|file>
Detect BOLA via ID mutation. Sequential, zero/neg, admin IDs, type-switch, UUID, enumeration, cross-account.
python cli.py bola https://api.example.com/v1/orders/1042
python cli.py bola https://... --auth user_a --alt-auth user_b
python cli.py bola https://... --enum-start 1 --enum-end 100
papister sqli <url|file>
Deep SQL injection: error-based, boolean-blind, time-based, stacked queries. Level 1–3.
python cli.py sqli https://api.example.com/search?q=test --level 3
papister jwt <token>
JWT attack suite: alg:none, claim tampering, kid injection, secret brute-force.
python cli.py jwt eyJ... --attack --url https://api.example.com
papister graphql <url>
GraphQL introspection, batching, deep nesting attacks, alias abuse.
python cli.py graphql https://api.example.com/graphql --attack
papister soap <url>
SOAP WSDL discovery, XXE injection, SOAPAction spoofing.
python cli.py soap https://api.example.com/service.wsdl --attack
papister fuzz <url>
Fuzz params with nulls, oversized strings, type confusion, path traversal, template injection.
python cli.py fuzz https://api.example.com/v1/users?id=1
papister browser <url>
Launch browser through Papister's proxy. Captures all API traffic, extracts auth, classifies endpoints, drops into attack menu.
python cli.py browser https://target.com
python cli.py browser https://target.com --name "admin panel"
python cli.py browser https://target.com --auto-bola
python cli.py browser https://target.com --profile-dir /tmp/session
papister sessions
List all past browser sessions. Shows ID, label, host, timestamps, endpoint and token counts.
python cli.py sessions
python cli.py sessions --limit 50
papister sessions-resume <id>
Reload a past session's auth context and endpoint list. Opens the attack menu without re-opening the browser.
python cli.py sessions-resume 3
papister auth set <name>
Configure and save an auth profile. Supports apikey, oauth1, oauth2, basic, custom headers.
python cli.py auth set my_bearer --type oauth2
python cli.py auth set mpesa_key --type oauth1
papister vault set <provider>
Encrypt API keys with AES-256-GCM. 12 provider schemas: Mpesa, Stripe, Binance, AWS, GitHub and more.
python cli.py vault set mpesa
python cli.py vault set stripe
python cli.py vault rotate binance
papister integrations run <name>
Full integration test suites for Mpesa, Africa's Talking, Flutterwave, Stripe, Twilio.
python cli.py integrations run mpesa --mode S
python cli.py integrations run stripe --mode S
papister proxy start
Start the built-in intercept proxy on 127.0.0.1:8787. All requests are logged to SQLite for replay.
python cli.py proxy start
python cli.py proxy start --port 9090
papister proxy replay <id>
Replay a previously captured request by its ID. Modify headers or body before replaying.
python cli.py proxy replay a1b2c3d4
Attack surface

12 attack modules, one command

Every module fires from the post-browser attack menu with your captured session automatically injected.

01
BOLA / IDOR
ID mutation across 6 strategies. The most common critical API bug.
OWASP #1
02
SQL injection
Error, blind, time-based, stacked. Level 1–3 depth control.
DEEP
03
Fuzzer
Param chaos — nulls, overflow, type confusion, traversal, SSTI.
FUZZ
04
JWT attacks
alg:none, claim tamper, kid injection, secret brute-force.
CRYPTO
05
GraphQL
Introspect, batching, deep nesting, alias abuse, field suggestion.
DEEP
06
SOAP / WSDL
WSDL discovery, XXE injection, SOAPAction spoofing.
XXE
07
Headers audit
HSTS, CSP, CORS misconfiguration, X-Frame. Score 0–100.
AUDIT
08
Fingerprint + CVE
Stack detect + automatic CVE cross-ref on found versions.
CVE
09
Full scan
Orchestrated scan across all captured endpoints with auth.
SCAN
M
Mail probe
POP3 / IMAP / SMTP — banners, capabilities, auth methods.
PROBE
R
POST replay
Re-fire captured POSTs with 6 body mutations — priv escalation, SQLi, type confusion, null.
REPLAY
A
Full pipeline
Run all 11 above in sequence. One command, full coverage.
ALL
Browser Mode

Browse once. Attack everything.

The full recon-to-exploit pipeline without leaving the terminal.

1
Launch browser through Papister's proxy
Chromium starts pointing to 127.0.0.1:8787. Your mitmproxy on 8081 stays untouched. Dedicated temp profile — won't touch your daily browser.
2
Browse and log in normally
Every API call — including lazy-loaded SPA routes — is captured in real-time. Live traffic table shows NEW / TOKEN / BOLA / GQL / SOAP tags as they appear.
3
Auth captured automatically
Authorization headers, X-API-Key, Cookie jar, Set-Cookie responses — all extracted, deduped, and saved to the local DB. No copy-pasting.
4
Close browser → attack menu appears
Pick any attack. Every module fires with your captured session injected. BOLA, SQLi, JWT, GraphQL, SOAP, POST replay — all as your logged-in user.
5
Session saved — resume anytime
papister sessions-resume 3 reloads auth and endpoints from a past session. Run more attacks without re-opening the browser.
papister — attack menu
⚔ Papister Attack Menu
✓ Auth: ACTIVE — attacks fire as your session
[1]BOLA / IDOR — ID mutation, enum, cross-account
[2]SQLi — error, blind, time-based, stacked
[3]Fuzzer — param chaos on all endpoints
[4]JWT attacks — alg:none, claim tamper, kid inject
[5]GraphQL — introspect, batch, deep nest
[6]SOAP / WSDL — XXE, SOAPAction spoof
[7]Headers audit — HSTS, CSP, CORS, X-Frame
[8]Fingerprint + CVE — stack + CVE cross-ref
[M]Mail probe — POP3/IMAP/SMTP
[R]Replay POST bodies — 6 mutations
[A]All attacks — full pipeline
[0] Exit
Get started

Running in under two minutes

No cloud setup, no API keys to create. Clone and run.

1
Clone the repo
git clone https://github.com/dmitriousben/papister
cd papister
2
Install dependencies
pip install -r requirements.txt
3
Run the DB migration
# sets up all tables including browser session tables
python storage/db_browser_migration.py
4
Start the proxy and browse
python cli.py proxy start # port 8787
python cli.py browser https://target.com
Requirements
🐍
Python
3.9 or later
📦
Typer + Rich
CLI framework and terminal output
🌐
Chromium / Chrome / Brave
For browser mode — auto-detected on PATH
🗄️
SQLite
Built into Python stdlib — no install needed
🔒
cryptography
AES-256-GCM for the vault