Burp Suite User Forum

Create new post

API scanning using dastardly

Mohammad | Last updated: Aug 20, 2023 01:10PM UTC

Hi. I am unable to scan api endpoint using api defination. SCRIPT > - task: CmdLine@2 displayName: Run DAST scan with dastardly inputs: targetType: 'inline' script: | docker run --user $(id -u) --rm -v $(pwd):/dastardly -e \ DASTARDLY_TARGET_URL=https://{myurl}/{basepath}/docs/ -e \ DASTARDLY_OUTPUT_FILE=/dastardly/dastardly-report.xml \ public.ecr.aws/portswigger/dastardly:latest true The SCAN ends in 1 second . PFB logs 2023-08-20T12:50:13.0232449Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:09 INFORMATION Crawl started. 2023-08-20T12:50:13.0236142Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:10 DEBUG {myurl} is using HTTP/2 2023-08-20T12:50:13.0237514Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:10 DEBUG Found API definition at location https://{myurl}:443/{mybasepath}/docs/. 2023-08-20T12:50:13.0238619Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:11 INFORMATION Crawl finished. 2023-08-20T12:50:13.0239345Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:11 INFORMATION Identifying items to audit. 2023-08-20T12:50:13.0240088Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:11 INFORMATION Audit started. 2023-08-20T12:50:13.0241845Z 2023-08-20 12:50:13 INFO dastardly.EventLogPrinter - Aug 20 2023 12:50:12 INFORMATION Audit finished. 2023-08-20T12:50:13.8514578Z 2023-08-20 12:50:13 INFO bsee.BurpProcess.scan.scan-1 - Deleting temporary files - please wait ... done. 2023-08-20T12:50:19.5270339Z ##[section]Finishing: Run DAST scan with dastardly

Alex, PortSwigger Agent | Last updated: Aug 21, 2023 08:08AM UTC

Hi, Thanks for your post. It's not clear from the logs what the issue is, but the scan time certainly suggests there was an issue in parsing the API definition. I would suggest one of two options below: You can try scanning the same definition using Burp Suite Professional, which would provide additional logging/insight into troubleshooting the issue. If you do not have access to Burp Suite Professional, I would be happy to test the API definition for you if you are able and happy to provide a copy. You can do so to support@portswigger.net marked for my attention. Best regards,

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.