Endpoint extraction
Static analysis pulls endpoints, methods, params, headers and cookies straight from code.
All projects
Attack Surface Detector
OWASP Noir
Hunt every endpoint in your source code, expose shadow APIs, and map the full attack surface — static analysis across 50+ frameworks, built for whitebox testing and security pipelines.
Crystal
MIT
OWASP Project
GitHub stars
50+
Frameworks
7
Output formats
2024
OWASP since
Capabilities
Source code in, attack surface out
Started as a personal project in August 2023 and an OWASP project since June 2024 — Noir turns a repository into an actionable inventory of every entry point.
50+ frameworks
Broad language and framework coverage, with an LLM fallback for the long tail.
Shadow API discovery
Surfaces undocumented handlers and deprecated routes that reviewers miss.
DAST hand-off
Feeds accurate route lists into ZAP, Burp Suite and Caido.
AI-ready SAST context
Emits guards, callees, sinks, validators and signals for LLM analysis.
Pipeline-native
JSON, YAML, OpenAPI, SARIF, cURL and Postman output with CI exit codes.
Quickstart
Point Noir at a repo, get a map your scanners can use
$ brew install noir
# map every endpoint in a source tree
$ noir -b ./app -f json
[*] 128 endpoints · 34 params · 5 shadow APIs
GET /api/v1/users/:id
POST /internal/debug/exec (undocumented)
Illustrative output from a sample project.
Map your attack surface.
Bring Noir into your pipeline and stop shipping shadow APIs.