grAPI - GitLite

KO | EN

gitlite — search

#pytorch #ui #nextjs #nlp #html #javascript #json #privacy #hacktoberfest #openai

grAPI

(★ 9)

No description available.

File Explorer

ZIP Download

- __init__.py
- cli.py
- core.py
- test_core.py
grAPI.py
LICENSE
Makefile
MANIFEST.in
pyproject.toml
README.md
requirements.txt
setup.cfg

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

Command Glossary

Commands referenced in this DOCs, explained below.

🔍

`git clone`

View Details ▼

Clone an existing repository.

git clone {{remote_repository_location}} {{path/to/directory}}

Clone an existing repository into a new directory (the default directory is the repository name):

git clone --recursive {{remote_repository_location}}

Clone an existing repository and its submodules:

git clone {{[-n|--no-checkout]}} {{remote_repository_location}}

Clone only the `.git` directory of an existing repository:

🔍

`pip install`

View Details ▼

Install Python packages.

pip install {{package1 package2 ...}}

Install one or more packages:

pip install {{package1 package2 ...}} {{[-U|--upgrade]}}

Upgrade all specified packages to the latest version, installing any that are not already present:

pip install {{package}}=={{version}}

Install a specific version of a package:

🔍

`python3`

View Details ▼

This command is an alias of `python`.

tldr python

View documentation for the original command:

🔍

`apt`

View Details ▼

Package manager for Debian-based distributions.
Intended as a user-friendly alternative to `apt-get` for interactive use.
For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>.

sudo apt update

Update the list of available packages and versions (recommended before running other `apt` commands):

apt search {{package}}

Search packages by name or description:

apt list {{package}}

Search packages by name only (supports wildcards like `*`):

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

**grAPI** is a simple but powerful utility for pentesters and security researchers who need to discover API endpoints on websites by interacting with them in real time. It uses Playwright under the hood to launch a real browser so you can explore the target and see API calls pop up in your terminal as they happen.

---

## What It Does

This tool:

* Opens your target URL in a real browser so you can click around just like a user.
* Captures any API endpoints the page hits via XHR, Fetch or other network calls.
* Scans loaded JavaScript files for hidden or hardcoded API paths.
* Gives you color coded output instantly so you don’t have to wait.
* Lets you save the endpoints in a simple txt or json file.
* Generates a Postman collection for easy import into Postman or Burp.

---

## Why It’s Useful

Unlike traditional scanners that only look at source code, grAPI listens to actual traffic as you use the page. That means it catches dynamic APIs that appear after a click, form submit or other interaction.

And because you do the browsing yourself, you control exactly which parts of the app you want to explore. The output is kept clean and minimal so you can jump straight into testing.

---

## Installation

Make sure you have **Python 3.10+** installed.

You can install grAPI using pip:
```bash
# Install grapi
pip install grapix

# Install Playwright browser binaries:

playwright install
```
Or from source:

```bash
git clone https://github.com/DghostNinja/grAPI.git
cd grAPI

# Install grapi
pip install .

# Install Playwright browser binaries
playwright install
```

- OPTIONAL:
  Add this line to your shell config (~/.bashrc, ~/.zshrc, or ~/.profile depending on your shell):
```bash
export PATH="$HOME/.local/bin:$PATH"
source ~/.bashrc   # or source ~/.zshrc
```

---

## 📦 Required Libraries for playwright browser
- ❌ Incase of OS or Dependency error:

```bash
sudo apt update && sudo apt install -y \
    libicu-dev \
    libjpeg-dev \
    libwebp-dev \
    libffi-dev \
    libnss3 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libxcomposite1 \
    libxdamage1 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libcairo2 \
    libasound2 \
    libxss1 \
    libxtst6
```
- Re-run the playwright install command after
---

## Usage

Here’s a typical example:

```bash
python3 grAPI.py --url https://targetsite.com -o apis.txt -p apis.postman.json
```
OR(Recommended):

```bash
grAPI --url https://targetsite.com -o apis.txt -p apis.postman.json
```

This will:

1. Launch the browser and open the target.
2. Print API endpoints as they happen — color coded by HTTP method.
3. Save them into a file (`apis.txt`) and a Postman collection (`apis.postman.json`).

When you’re done exploring the app, hit **Enter** in your terminal to stop the scan.

---

## Optional Arguments

| Argument    | Description                                              |
| ----------- | -------------------------------------------------------- |
| `--url`     | Target page URL                                          |
| `--timeout` | Page load timeout in seconds. `0` disables timeout       |
| `--scroll`  | Automatically scrolls the page to trigger more API calls |
| `-o`        | Output filename for saving endpoints (txt or json)       |
| `-p`        | Export captured endpoints as a Postman collection file   |

---

## Example Output

```bash
[API detected] POST: http://crapi.apisec.ai/identity/api/auth/forget-password
[API detected] GET: http://crapi.apisec.ai/shop/api/products
[JS-detected] /user/profile/update-profile-picture/
```

After hitting Enter:

```bash
[+] Total API endpoints captured: 3
[+] Saved 3 endpoints to apis.txt
[+] Saved Postman collection to apis.postman.json
```

---

## License

This project is licensed under the terms of the [MIT License](LICENSE). You are free to use, modify, and distribute it as needed.

---

## Contribute

If you’ve got feature ideas or improvements, feel free to open an issue or send a pull request.

That’s it. Have fun breaking things and stay curious.

Made with ☕ by [iPsalmy](https://github.com/DghostNinja)