owasp-noir/noirHunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Documentation • Installation • Usage • Contributing • Changelog
Noir is a SAST tool that reads source code and extracts the endpoints an application exposes — paths, methods, parameters, headers, cookies, and the source files behind them. Shadow APIs, deprecated routes, and undocumented handlers come out as part of the same inventory; they aren't a separate mode.
The inventory feeds three audiences:
--include callee--ai-context--include callee, the 1-hop functions each handler invokes) is the focused context an LLM auditor needs to find attacker-reachable bugs. --ai-context goes further and attaches aggregated review context per endpoint — guards, callees, sinks, validators, and signals — so the LLM doesn't have to rediscover them.noir -h
Example
noir -b <source_dir>
If you use it with Github Action, please refer to this document .
For more details, please visit our documentation page.
Noir started as a WhiteBox testing aid: extract endpoints from source so DAST can scan them more accurately. The job has grown — the same inventory now feeds human auditors and AI SAST agents too. The goal from here is to serve all three consumers equally well: humans reviewing the code, LLMs auditing it, and DAST tools scanning it.
From here:
OWASP Noir joined the OWASP Foundation in June 2024.
Noir is an open-source project made with ❤️. If you would like to contribute, please check CONTRIBUTING.md and submit a Pull Request.
 | Our mascot is Hak (학), a crane symbolizing elegance and precision in spotting hidden flaws. In Korean, "학" means "crane," representing a sharp ally who dives deep to uncover vulnerabilities and attack surfaces in your code. For more artwork and resources related to Hak, check out noir-artwork repository. |
|---|