██████╗ █████╗ ██████╗ ██╗███████╗████████╗███████╗██████╗ ██╔══██╗██╔══██╗██╔══██╗██║██╔════╝╚══██╔══╝██╔════╝██╔══██╗ ██████╔╝███████║██████╔╝██║███████╗ ██║ █████╗ ██████╔╝ ██╔═══╝ ██╔══██║██╔═══╝ ██║╚════██║ ██║ ██╔══╝ ██╔══██╗ ██║ ██║ ██║██║ ██║███████║ ██║ ███████╗██║ ██║ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
Command Reference
Local API Security & Testing Toolkit · v0.1.0 Local Only CLI First
Core — Scanning
papister scan <file>
Scan all endpoints from a collection file (.txt / .yaml / .json). Prints live results, summary, and writes JSON + HTML reports.
# Scan a .txt file in sandbox mode (default)
python cli.py scan endpoints/endpoints.txt
# Scan a YAML collection in production mode
python cli.py scan endpoints/endpoints.yaml --mode P
# Custom timeout + retries + proxy
python cli.py scan endpoints/endpoints.json --timeout 30 --retries 3 --proxy http://127.0.0.1:8080
# Skip SSL verification (dev certs)
python cli.py scan endpoints/endpoints.yaml --no-ssl-verify
| Flag | Default | Description |
|---|---|---|
| --mode S|P | S | S = Sandbox · P = Production (requires confirm) |
| --timeout | 15 | Seconds per request before timeout |
| --retries | 2 | Retry count on 5xx responses |
| --proxy | None | Route requests through a proxy URL |
| --no-ssl-verify | off | Disable SSL cert verification |
papister test <url>
Test a single endpoint. Shows full result detail inline.
python cli.py test https://api.example.com/v1/users
python cli.py test https://api.example.com/v1/login --method POST --auth my_bearer
python cli.py test https://api.example.com/v1/data --mode P
| Flag | Default | Description |
|---|---|---|
| --method / -X | GET | HTTP method |
| --mode / -m | S | S or P |
| --auth / -a | None | Name of saved auth profile |
| --proxy | None | Proxy URL |
| --timeout / -t | 15 | Timeout in seconds |
papister add <url>
Add a newly discovered endpoint to storage/discovered.yaml and the local DB.
python cli.py add https://api.example.com/v1/internal/debug
python cli.py add https://api.example.com/v1/admin --method POST
Security
DEEP
papister sqli <url|file>
Deep SQL injection testing. Runs error-based, boolean-blind, time-based, and stacked query detection.
# Test a single URL (level 1 = error-based only)
python cli.py sqli https://api.example.com/v1/users?id=1 --level 1
# Level 2 adds boolean-blind
python cli.py sqli https://api.example.com/v1/items?search=test --level 2
# Level 3 adds time-based + stacked (deepest)
python cli.py sqli endpoints/endpoints.yaml --level 3 --timeout 30
| Flag | Default | Description |
|---|---|---|
| --level / -l | 2 | 1=error · 2=+boolean-blind · 3=+time+stacked |
| --timeout / -t | 20 | Higher timeout needed for time-based checks |
| --proxy | None | Route through proxy |
FUZZ
papister fuzz <url>
Fuzz endpoint parameters with unexpected values — nulls, oversized strings, type confusion, path traversal, template injection.
python cli.py fuzz https://api.example.com/v1/users?id=1
python cli.py fuzz https://api.example.com/v1/search?q=test --method POST
HEADERS
papister headers <url>
Audit security headers — HSTS, CSP, X-Frame-Options, CORS misconfiguration, exposed server info. Gives a security score 0–100.
python cli.py headers https://api.example.com
python cli.py headers https://api.example.com --proxy http://127.0.0.1:8787
FINGERPRINT
papister fingerprint <url>
Detect the full backend stack — web server, framework, language, cloud provider, Redis exposure, Spring Boot Actuator, Kafka, message brokers. Cross-references detected versions against local CVE DB.
python cli.py fingerprint https://api.example.com
python cli.py fingerprint https://api.example.com --no-cve
| Flag | Default | Description |
|---|---|---|
| --cve / --no-cve | --cve | Cross-check detected versions against CVE DB |
| --proxy | None | Proxy URL |
MAIL
papister mailprobe <host>
Probe POP3, IMAP, SMTP endpoints. Reads banners, capabilities, auth methods. Useful for testing telecom/ISP mail API gateways.
python cli.py mailprobe mail.example.com
python cli.py mailprobe mail.example.com --port 995
CVE Database
papister cve update
Pull the latest NVD CVE feed into the local cve.db. Run periodically to keep findings current.
python cli.py cve update
papister cve check <tech> <version>
Manual CVE lookup for a specific technology and version string.
python cli.py cve check nginx 1.18.0
python cli.py cve check spring-boot 2.5.4
python cli.py cve check django 3.2.0
Auth Profiles
papister auth set <name>
Interactively configure and save an auth profile. Profiles are stored in the local DB and referenced by name in scans.
# API Key header auth
python cli.py auth set my_api_key --type apikey
# OAuth2 Bearer token
python cli.py auth set my_bearer --type oauth2
# OAuth1 consumer key + secret (Mpesa, etc.)
python cli.py auth set mpesa_consumer --type oauth1
# HTTP Basic
python cli.py auth set my_basic --type basic
# Custom raw headers
python cli.py auth set custom_till --type custom
Then reference in collection files: auth_profile: my_bearer
Or on CLI: papister test <url> --auth my_bearer
papister auth list
List all saved auth profiles.
python cli.py auth list
Intercept Proxy
PROXY
papister proxy start
Start the built-in intercept proxy on 127.0.0.1:8787. All requests are logged and can be replayed.
python cli.py proxy start
python cli.py proxy start --port 9090
papister proxy replay <request-id>
Replay a previously captured request by its ID (shown during capture).
python cli.py proxy replay a1b2c3d4
Integrations
papister integrations list
Show all available third-party integration test suites.
python cli.py integrations list
| Name | Description |
|---|---|
| mpesa | Safaricom Daraja — OAuth, STK Push, C2B, B2C, Balance |
| africastalking | Africa's Talking — SMS, USSD, Voice, Airtime |
| flutterwave | Flutterwave — Card, Mobile Money, Bank Transfer |
| stripe | Stripe — Charges, Customers, Webhooks |
| twilio | Twilio — SMS, Voice, Verify |
papister integrations run <name>
Run a full integration test suite. Use --mode S for sandbox, P for production.
python cli.py integrations run mpesa --mode S --auth mpesa_consumer
python cli.py integrations run stripe --mode S --auth stripe_key
python cli.py integrations run africastalking --mode P --auth at_key
History & Reports
papister history
Show past scan runs stored in local SQLite DB.
python cli.py history
python cli.py history --limit 50
python cli.py history-show 42
papister report [timestamp]
Open an HTML report in the browser. No argument = latest report.
python cli.py report
python cli.py report 20240601_143022
Utility
papister version
Show current Papister version and CVE DB last-updated date.
python cli.py version
papister docs
Open this command reference page in the browser.
python cli.py docs
Papister v0.1.0 · Local API Security & Testing Toolkit ·
python cli.py --help for CLI help