Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scan API with Burp Suite Pro v2021.3.1

Sally | Last updated: Apr 09, 2021 06:29PM UTC

Hi, I saw this post (https://portswigger.net/blog/api-scanning-with-burp-suite) where it mentioned Burp Suite Pro and Enterprise is now able to read the OpenAPI file, however I'm not sure where I can import the OpenAPI file into Burpsuite, is it through OpenAPIParser extension? I've tried OpenAPIParser where I can import an OpenAPI file and send the API collection to the Target Sitemap, but it only takes OpenAPIv2, as OpenAPIv3 generate errors. Regards, SS

Uthman, PortSwigger Agent | Last updated: Apr 12, 2021 08:46AM UTC

Hi SS, For API scanning to work, you need to provide the scanner with a URL to a hosted OpenAPIv3 definition file. You can do this by launching a new scan > Entering the URL of the definition (e.g. https://petstore3.swagger.io/api/v3/openapi.json) under URLs to Scan. You can find further information below: - https://portswigger.net/burp/documentation/desktop/scanning/api-scanning The OpenAPI Parser extension can be used for offline definition files but this is not managed by PortSwigger so you will need to report any issues with the extension to the original developer: - https://github.com/aress31/swurg/issues

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.