Burp Scanner can scan APIs for vulnerabilities. This enables you to discover a larger attack surface in your applications.
Both Burp Suite DAST and Burp Suite Professional enable you to upload an API definition to be scanned. Burp Scanner automatically detects endpoints, parameters, and authentication details in the definition, then audits the detected endpoints.
Burp Scanner also parses any API definitions that it encounters as part of its regular crawling activity, then crawls and audits any endpoints that it discovers.
To disable API scanning during regular crawling activity, deselect the Parse API definitions crawl option in the Discovery logic section of your custom scan configuration.
Burp Scanner can parse and scan OpenAPI definitions, SOAP WSDLs, and Postman Collections that meet the criteria listed in each section.
Burp can parse OpenAPI definitions that:
Are in JSON or YAML format.
Do not contain external references.
Contain server URLs that are reachable by Burp Scanner.
When uploaded from a file, contain absolute URLs for server URLs.
Burp Scanner identifies each server-path-method combination as a separate endpoint. For example, if an API definition includes three servers, and each supports GET and POST, Burp identifies six endpoints.
When auditing OpenAPI endpoints, Burp Scanner follows these rules:
For optional parameters, it sends:
One request with only mandatory parameters.
One request with both mandatory and optional parameters.
For enumerated types, it sends a separate request for each permitted value.
For numeric values, it uses the maximum and minimum values in its requests.
If the API definition includes example parameter values, it includes the final example in its request.
If no example values are provided, Burp Scanner generates values to use in requests:
For arrays, it creates the minimum required number of values.
For path parameters, it generates a minimum, maximum, and random value, sending separate requests for each.
If Burp can't scan any endpoints in your OpenAPI definition, it logs these in the event log.
Burp can parse SOAP WSDLs that:
Are in WSDL format.
Do not contain external references.
Contain server URLs that are reachable by Burp Scanner.
When uploaded from a file, contain absolute URLs for server URLs.
When auditing SOAP endpoints, Burp Scanner follows these rules:
Content type is determined automatically from the SOAP version for each endpoint.
Optional parameters are always sent.
For enumerated types, it sends a single request using the first permitted value.
For numeric values, it sends a single request using a randomly generated value.
If the API definition includes example parameter values, it includes the first example in its request.
For endpoints without example parameter values, it sends a single request using a randomly generated value.
For an array, it sends the minimum required number of values to send in its request.
If Burp can't scan any endpoints in your SOAP WSDL, it logs these in the event log.
Burp Suite can parse Postman Collections that:
Are exported in v2.1.0 format.
Contain server URLs that are reachable by Burp Scanner.
Contain absolute server URLs.
Burp doesn't currently support the following Postman features:
Variables are supported, but environments are not. You need to define Collection variables manually in Postman's Variables tab, or by editing your exported JSON to make sure the correct values are used.
Scripts are not currently supported.
When auditing Postman requests, Burp Scanner follows these rules:
If variables aren't defined for placeholders, Burp will use a random value.
Burp cannot scan Postman requests that:
Have a body type of file.
Have a body type of formdata.
Have a body type of graphql.
If Burp can't send any requests in your Postman Collection, it logs these in the event log.
Burp Scanner can scan and audit GraphQL API endpoints during a crawl and audit. GraphQL crawls rely on introspection. This is a built-in GraphQL feature that enables users to query the structure of the API itself.
If GraphQL scanning is enabled, Burp Scanner uses the following process when crawling:
For more information on how to test GraphQL APIs effectively, see the GraphQL API vulnerabilities Web Security Academy topic.