OWASP Noir: the new open-source tool for static analysis of API vulnerabilities

OWASP Noir emerges as a revolutionary tool for web application security, capable of identifying exposed endpoints by analyzing the source code directly. Its ability to detect shadow APIs - undocumented interfaces but present in the code - represents a significant advancement in web application security, offering complete visibility on all possible attack paths.

Quick Answer

OWASP Noir is an open-source static code analysis tool that:

  • Identifies all endpoints exposed by an application, including shadow APIs and deprecated routes
  • Supports 29 programming languages and 205 frameworks without the need for plugins
  • Integrates security analysis with detection of hardcoded keys and credentials
  • Generates output in 22 different formats for various security tools

How OWASP Noir Works

The operation of Noir is based on advanced static analysis that examines the source code to identify:

  • All exposed paths
  • HTTP methods used
  • Parameters, headers, and cookies associated
  • Exact location in the source code of each element

This analysis is particularly effective in detecting shadow APIs - interfaces that exist in the code but are not documented or accessible through normal navigation paths. These hidden endpoints represent a significant security risk, as they may contain untested vulnerabilities.

Comparison with Traditional DAST Tools

The key difference between Noir and traditional Dynamic Application Security Testing (DAST) tools like OWASP ZAP or Burp Suite lies in the method of analysis. While dynamic scanners analyze a running application trying to navigate all paths, Noir examines the source code directly.

This fundamental difference means that Noir can identify endpoints that dynamic scanners will never detect, simply because they are not reachable through standard navigation. An application might therefore respond to requests on these unknown paths, creating potential attack vectors not detected by traditional tools.

Extended Support for Languages and Frameworks

Noir supports a wide range of programming languages and frameworks, with impressive coverage of 29 languages and 205 different frameworks. This extended support is made possible by a single binary that does not require language-specific plugins or configurations.

The tool is able to automatically detect the language, framework, and routing conventions used in an application. When predefined static rules fail to correctly identify a framework or when custom routing is used, Noir can integrate advanced language models (LLM) through providers like OpenAI or Ollama.

Advanced Security Analysis

In addition to identifying endpoints, Noir performs passive scanning rules that classify the severity of detected vulnerabilities. The system identifies hardcoded keys, tokens, and credentials embedded in the source code, which represent serious security risks.

Noir also uses 17 different taggers to classify endpoints based on their characteristics, such as the presence of JWT, payment handlers, administrative interfaces, or file upload management. This classification allows security reviewers to prioritize the analysis of the most critical endpoints, such as those related to payments or administrative functionalities.

Integration with Other Security Tools

The project is designed to be used by three different types of users: human reviewers, AI-based code auditors, and DAST tools. For human reviewers, Noir provides a complete list of all potential entry points accessible to attackers.

For AI-based code auditors, Noir provides the same list of endpoints along with additional context that includes guards, sinks, validators, and signals associated with each endpoint. This allows language models to analyze one handler at a time.

DAST tools like OWASP ZAP, Burp Suite, Caido, and Gori can use the endpoints identified by Noir as proxy targets or import them in standard formats like OpenAPI.

Supported Output Formats

Noir offers unparalleled flexibility in generating security reports, supporting as many as 22 different output formats, including:

  • JSON
  • SARIF (Static Analysis Results Interchange Format)
  • OpenAPI
  • Postman
  • cURL

This wide range of formats allows the tool to be integrated into various development and operational environments. Noir is also available as a GitHub Action, enabling direct integration into continuous integration (CI) pipelines.

Availability and Access

OWASP Noir is freely available on GitHub, making it accessible to developers and security teams of all sizes. Its open-source nature and wide range of features make it a valuable tool for anyone working in web application security.

For more information on open-source security tools, you can consult our guide on 20 open-source cybersecurity tools.

The Impact of OWASP Noir on the API Security Landscape

The introduction of OWASP Noir represents a turning point in the field of web application security, particularly for companies managing complex APIs. According to recent market analyses, 60% of API breaches are attributable to undocumented or deprecated endpoints, a problem that Noir addresses directly. This tool fits into a context where companies spend on average 25% of their security budget on API protection, according to a Gartner report.

The adoption of Noir could significantly reduce these costs, offering a more efficient alternative to traditional dynamic analysis tools. Furthermore, its ability to integrate with advanced language models (LLM) makes it particularly suitable for companies using custom frameworks, an area where traditional DAST tools often fail.

Implications for Compliance and Risk Management

For companies subject to regulations such as the NIS2 Directive or the DORA Regulation, Noir offers a systematic method for identifying and documenting all exposed endpoints, a key requirement for compliance. The ability to generate output in standard formats like SARIF and OpenAPI facilitates integration with existing security management systems, simplifying the audit and reporting process.

For Managed Detection and Response (MDR) providers, Noir represents a valuable tool for improving the depth of analysis during security assessments. The ability to detect hidden endpoints and code-specific vulnerabilities can significantly improve the quality of security reports provided to clients. Additionally, integration with DAST tools like OWASP ZAP and Burp Suite allows for combining static and dynamic analysis for comprehensive coverage.

Advanced Use Cases

A particularly interesting use case for Noir is the analysis of legacy applications, where endpoint documentation is often incomplete or outdated. In these scenarios, Noir can reveal forgotten endpoints that may have been exposed to security risks for years. This is particularly relevant for companies operating in highly regulated sectors, such as finance or healthcare, where non-compliance can result in heavy penalties.

For companies using microservices, Noir can be integrated into their continuous integration (CI) pipelines to ensure that every new deployment does not introduce unauthorized endpoints. This capability is crucial for maintaining a robust cloud security posture, particularly for organizations adopting container-based and orchestrated architectures.

Considerations for Ransomware Protection

Noir's ability to identify undocumented endpoints is particularly useful for ransomware protection. Many ransomware attacks exploit hidden endpoints to gain privileged access to systems. By identifying these endpoints, Noir can help close attack vectors that might otherwise be exploited to distribute ransomware payloads.

Additionally, the ability to detect hardcoded keys and credentials in the source code is crucial for preventing privilege escalation, a common technique used by ransomware to spread within a network. This makes Noir a valuable tool for breach remediation and incident response strategies.

The Future of OWASP Noir

With the growing adoption of API-based architectures, it is likely that Noir will become an industry standard for static application analysis. The open-source project, hosted on GitHub, benefits from a wide community of contributors who can help expand support for new frameworks and programming languages.

A promising direction for the future development of Noir is deeper integration with advanced language models. This could allow Noir not only to identify endpoints but also to analyze the semantic context of the code to detect more subtle vulnerabilities, such as weak authentication logic or unsafe data manipulations.

OWASP Noir represents a significant step forward in web application security, offering a comprehensive solution for identifying and managing exposed endpoints. Its ability to integrate static analysis with advanced technologies like language models makes it a versatile tool for a wide range of security scenarios. For companies seeking to improve their NIS2 compliance or strengthen their digital operational resilience, Noir provides a systematic method for identifying and mitigating API-associated risks.

As the cybersecurity landscape continues to evolve, tools like Noir will be fundamental to maintaining application security in an increasingly complex and interconnected environment.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.