Body parameters of this type are supported.
For example, JSON parameters in an application/x-www-form-urlencoded body. Query or body parameters with embedded mixed types.JSON body parameters of this type are supported. Query or body parameters of type array.However, it can use Burp's normal authentication-handling features when scanning APIs.īurp Scanner only supports server and path parameters if they are of an enumerated type or if example values are provided in the definition.īurp Scanner does not support endpoints that require any of the following to be present in the request: Any endpoints that do not conform to these criteria are excluded from the scan:īurp Scanner cannot handle any authentication that is implemented on the endpoint level. If the API definition provides example sets of parameters, Burp Scanner uses the final provided example in its request.īurp Scanner can only scan API endpoints that meet certain criteria. If an endpoint uses numeric values, Burp Scanner uses the maximum and minimum values as specified. If an endpoint uses enumerated types, Burp Scanner sends a separate request for each of the parameter's permitted values. If an endpoint has optional parameters, Burp Scanner sends at least two requests to that endpoint: one containing only mandatory parameters and one containing both mandatory and optional parameters. For example, if a definition had three servers, each with GET and POST methods, then Burp Scanner would identify six endpoints. However the crawler still needs to try a reasonable number of possible parameter combinations to make sure that it exposes all possible attack surfaces.Īs such, Burp Scanner sends requests in line with the following rules:īurp Scanner treats every combination of in-scope server and path methods (such as GET and POST) in the API definition as its own endpoint. In these cases, it would be impossible for the crawler to attempt all parameter combinations. For example, an open String parameter with no constraints would have a virtually unlimited number of potential valid inputs. Burp Scanner can then derive new locations to crawl and audit based on the endpoints that it discovers.ĭepending on the design of the API, each endpoint could have a huge number of potential parameters. Burp Suite will generate a pop-up from which a number of options. In the Intruder window, select Save > Results Table.
Making it human-readable is another thing. Using Burp Suite, it’s relatively easy to generate dumps of all the tests that were performed by using Intruder.
#Burp suite rest api testing series
When crawling an API definition, Burp Scanner sends a series of requests to identify potential endpoints, along with their supported methods and parameters. How Burp Suite can help with reporting Penetration Testing REST APIs.
0 kommentar(er)
