SecSuite: AI-Powered OSINT, Web, and API Security Testing Tool

Key Takeaways

• TheSecuredAnalyst project has released SecSuite, a new open-source, AI-powered security testing platform.
• SecSuite integrates OSINT, web, and API security testing with local AI analysis for enhanced vulnerability identification and remediation.
• The tool offers comprehensive features including 11 OSINT, 6 web security, and 4 API security modules, all operable offline with local AI models.
• Its unique AI-driven remediation engine interactively guides users through fixing identified vulnerabilities with real-time shell commands.
• Available now on GitHub, SecSuite v0.1.0 targets security professionals, penetration testers, and red teams.

TheSecuredAnalyst project has introduced SecSuite, an innovative open-source security platform designed to consolidate a wide array of cybersecurity testing capabilities. This new toolkit brings together OSINT reconnaissance, web vulnerability scanning, API security assessment, compliance checking, and advanced AI-powered analysis into a single, unified solution.

SecSuite is accessible on GitHub via the 53cur3dL34rn/security-suite repository. It is specifically developed for security professionals, penetration testers, and red teams who require a flexible, modular suite that can operate completely offline, leveraging local AI models for sensitive tasks.

Comprehensive Module Integration

The initial release, SecSuite v0.1.0, features a robust set of tools: 11 OSINT modules, 6 web security scanners, and 4 API security testing tools. All these functionalities are managed through a unified command-line interface (CLI) or a REST API built on FastAPI, offering versatile deployment and integration options.

The platform’s AI capabilities are powered by three distinct providers: Ollama, which enables fully local and offline inference; Anthropic Claude; and OpenAI GPT. This multi-provider AI layer facilitates automated correlation of findings, generation of executive summaries, and interactive, LLM-driven remediation workflows, positioning SecSuite as one of the most comprehensive open-source security suites currently available.

Effortless Deployment and Operation

SecSuite prioritizes ease of use, featuring a streamlined setup process. A single script—setup.sh for Linux/macOS or setup.ps1 for Windows—manages the entire installation, including Python, all necessary dependencies, Ollama, and a local AI model. Crucially, no administrator privileges are required for installation on Windows systems.

The suite’s design supports the entire lifecycle of attack surface reconnaissance and testing, encompassing a broad range of capabilities:

AI-Driven Remediation

A standout feature of SecSuite is its AI-driven remediation engine, accessible via secsuite ai remediate. Unlike traditional tools that merely generate static reports, this module actively guides operators through the process of fixing identified issues. After scanning a target and pinpointing vulnerabilities, it uses a local LLM to interactively suggest solutions.

For each vulnerability, such as an unauthenticated Redis instance, the AI provides specific shell commands—[CHECK], [FIX], and [VERIFY]—that users can execute, modify, or bypass in real time. This functionality significantly bridges the gap between vulnerability detection and practical remediation, a workflow that typically necessitates multiple disparate tools. Importantly, this entire process relies on local models like Qwen2.5 or LLaMA 3.2 through Ollama, ensuring that no scan data, credentials, or infrastructure details ever leave the operator’s secure environment.

Advanced API Security Testing

The apisec module is specifically engineered to target REST APIs by processing OpenAPI/Swagger specifications and systematically testing discovered endpoints. It comprises three specialized sub-modules to address different attack vectors:

• endpoints: Focuses on detecting vulnerabilities such as BOLA/IDOR, SQL/NoSQL/command injection, mass assignment, and information disclosure.
• auth: Scans for authentication bypasses, broken authentication mechanisms, JWT weaknesses (including the none algorithm attack and missing exp claims), and rate-limiting deficiencies.
• fuzzer: Employs boundary values, injection payloads, and malformed request bodies to uncover potential crashes and data leaks.

The REST API server, activated with secsuite serve, exposes these capabilities as programmatic HTTP endpoints. This allows for seamless integration into existing CI/CD pipelines, security orchestration platforms, or custom tools via curl or Python clients.

Robust Web Scanning Capabilities

The web scanner module has demonstrated its effectiveness in identifying practical vulnerabilities. In a documented demo output, a scan of example.com accurately flagged SSLv3 as enabled, indicating susceptibility to the POODLE attack (CVE-2014-3566). This real-time SSL/TLS analysis module quickly checks for deprecated protocol support, weak cipher suites, and certificate chain issues, completing tests in under one second in recorded instances.

Further enhancing the web testing surface, the module includes XSS and SQL injection scanners, directory brute-force capabilities using wordlists, and vulnerability scanning based on Nuclei templates.

Flexible Architecture and Data Export

SecSuite’s architecture is structured into three distinct layers: a user interface layer (CLI via Typer + REST API via FastAPI), a core infrastructure layer (handling target modeling, caching, HTTP client, and exporters), and a scanning module layer. This separation of concerns ensures modularity and maintainability.

All scan results can be exported in various formats, including JSON, CSV, HTML, or Markdown. A scheduler module enables cron-based recurring scans with persistent history, while SIEM integration supports CEF/LEEF formatted log delivery to Splunk, Elasticsearch, and Syslog pipelines, as well as webhook delivery to platforms like Slack, Discord, and PagerDuty.

All external API keys, including those for Shodan, VirusTotal, Anthropic, and OpenAI, are optional. The core functionality of SecSuite operates entirely without these external keys by leveraging Ollama for local AI inference, making the tool fully functional in air-gapped or restricted network environments. The modular design further allows teams to selectively adopt only the components relevant to their specific assessment requirements.

What You Should Do

• Download and Explore: Access SecSuite v0.1.0 on GitHub to begin testing its capabilities in your authorized security assessments.
• Integrate into Workflows: Leverage the REST API to integrate SecSuite into existing CI/CD pipelines, security orchestration platforms, or custom scripts for automated security testing.
• Utilize AI Remediation: Experiment with the AI-driven remediation engine to streamline vulnerability patching and reduce the time between identification and resolution.
• Prioritize Local AI: For sensitive environments, configure SecSuite to use local AI models via Ollama to ensure data privacy and operational independence.
• Customize Modules: Selectively enable and configure only the OSINT, web, and API security modules that align with the specific scope of your penetration tests or red team exercises.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.