Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

API Scanning with Burp Enterprise

Hugo | Last updated: Oct 31, 2022 10:41AM UTC

Hello, I would like to scan APIs with Burp Enterprise. I have the relevant OpenAPI specs as files (JSON or YAML). However, it is unclear how I can leverage them to configure my scans, and I cannot find a clear documentation about it. Could it be possible to have some help with that? Thanks in advance!

Alex, PortSwigger Agent | Last updated: Oct 31, 2022 10:59AM UTC

Hi Hugo, Thanks for your post. API scanning documentation can be found here: https://portswigger.net/burp/documentation/desktop/scanning/api-scanning Your definition will need to be hosted at a URL that Enterprise can target as part of its scan. This will either be added as the main site URL if you are only scanning the definition, or you can add the URL to the "Included URLs" section of the site configuration to bring it into scope along with your target application. Here is an example from the swagger website: https://petstore3.swagger.io/api/v3/openapi.json Best regards,

Hugo | Last updated: Oct 31, 2022 11:05AM UTC

Hi Alex, My API specs are not hosted on my target, so I tried hosting it elsewhere (actually on the Burp Server itself). My target is: https://target.com I have performed the two several sites/scans configuration: 1) In my scope, I've added the target, and in additionnal URL I have added http://127.0.0.1/api_specs.json (I've tested it, the json file can be accessed this way). 2) In my scope, I have just added http://127.0.0.1/api_specs.json None of these solutions works. The scanner doesn't seem to find the endpoints. Is it supposed to work if my specs are not hosted on the same domain as the actual target?

Alex, PortSwigger Agent | Last updated: Oct 31, 2022 11:27AM UTC