v0.29.1 OWASP Project

Hunt Endpoints. Expose Shadow APIs. Map the Attack Surface.

Source code to attack surface in seconds. Static analysis for endpoints, parameters, and hidden routes across 50+ frameworks.

Get Started GitHub

noir

$ noir -b .

INFO Detected 1 technologies: crystal_kemal

INFO Analysis Started. Code Analyzer: 1 in use

Finally identified 6 endpoints. in 0.0032s

GET /

POST /query

GET /token

GET /socket websocket

POST /admin/config shadow

GET /admin/debug shadow

50+ Languages & Frameworks

20+ Output Formats

AI Powered Analysis

OSS Open Source

Capabilities

Source code to attack surface in seconds

Attack Surface Discovery

Analyzes source code to uncover the complete attack surface — hidden endpoints, shadow APIs, undocumented routes, and security blind spots that manual review misses.

Multi-Language

Crystal, Ruby, Python, Go, Java, Kotlin, JS/TS, PHP, C#, and more. One tool for your entire stack.

AI-Powered

LLM integration detects endpoints even in unsupported frameworks. Nothing escapes.

DevSecOps Ready

CI/CD native. GitHub Actions, JSON/YAML/SARIF output. Plug into ZAP, Burp, Caido.

SAST-to-DAST Bridge

Discovered endpoints feed directly into dynamic testing tools. Static analysis meets dynamic scanning.

Flexible Output

JSONJSONLYAMLTOMLOpenAPI 2.0OpenAPI 3.0SARIFHTMLMarkdowncURLHTTPiePowerShellPostmanMermaidOnly-URLOnly-ParamOnly-HeaderOnly-CookieOnly-Tag

Workflow

Three steps to full visibility

Point to your codebase

Noir auto-detects the language, framework, and routing patterns. No config needed.

$ noir -b ./your-project

Discover every endpoint

Static analysis maps all routes, parameters, and headers. AI fills in the gaps for unknown frameworks.

Feed your pipeline

Export to JSON, OpenAPI, SARIF, or send directly to DAST tools. Integrate with CI/CD in one line.

$ noir -b . -f oas3 --send-proxy http://localhost:8090

Built With

Open Source

Join the Community

OWASP Noir is built by the community. Contribute, report issues, or just star the repo.

Contributing Guide Star on GitHub

Thanks to our contributors