ExploitSpec

Free · local-first · Apache-2.0

Make the security fix permanent.

ExploitSpec turns a proven HTTP exploit into a small, reviewable regression test—so CI can catch the behavior if it returns.

Listed as an API testing tool in the OWASP® Community API Security Tools list. OWASP® is a registered service mark of the OWASP Foundation, Inc. Inclusion does not imply endorsement, certification, or OWASP project status.

Run the 60-second demo Install free
  • No account
  • No telemetry
  • No paid tier

$ exploitspec calibrate finding.yaml

  1. RED Fails on vulnerable baseline ✓
  2. GREEN Passes after the fix ✓
  3. STABLE Fix passes 3 of 3 runs ✓

Calibration accepted. Ready for CI.

Plain YAMLReview it in every pull request

Multi-actorModel real authorization boundaries

CI-readyJSON, JUnit, and deterministic exits

PrivateRuns locally against targets you choose

Evidence in. Signal out.

A finding should outlive the report.

Keep the exploit's security invariant beside the application code, where engineers can rerun it locally and in CI.

  1. 01

    Start with proof

    Take a vulnerability already confirmed by a human—such as a BOLA/IDOR finding.

  2. 02

    Capture the invariant

    Describe actors, requests, dynamic values, and the boundary the fix must preserve.

  3. 03

    Guard it in CI

    Prove RED, GREEN, and STABLE—then fail the build if the vulnerability returns.

Terminal output showing a BOLA invariant fail on the vulnerable baseline, pass after the fix, and remain stable for three runs.
The repository includes a deliberately vulnerable and fixed local API for a real calibration run.

Designed for security boundaries

Small enough to review. Strong enough to trust.

ExploitSpec stays deliberately narrow: it replays invariants that a human has already decided are meaningful. It is not a vulnerability scanner.

Multi-actor workflows

Give owners and attackers isolated headers, cookies, and HTTP sessions.

Dynamic captures

Capture an ID, header, or regex match and reuse it in later requests.

Useful failure signals

Emit readable text, machine-readable JSON, or JUnit for ordinary pipelines.

Safe by default

Require explicit remote-host authorization, bound responses, and block metadata IPs.

Evidence import

Turn selected cURL or HAR requests into conservatively redacted starter specs.

Open by construction

One Apache-2.0 edition. No hosted service, analytics, or feature gates.

Start in one command

Install ExploitSpec.

Use the verified Homebrew tap on macOS or Linux, or install the latest tagged release with Go. Prebuilt archives are available for macOS, Linux, and Windows.

Homebrew tap Release archives

Homebrew

brew install pazent/exploitspec/exploitspec

Go

go install github.com/pazent/exploitspec/cmd/exploitspec@latest

The bug was fixed.

What proves it stays fixed?

Run the local BOLA/IDOR demo, inspect the YAML, and decide whether ExploitSpec belongs in your CI.

See the passing demo View the source