![]() However, it can use Burp's normal authentication-handling features when scanning APIs. ![]() Any endpoints that do not conform to these criteria are excluded from the scan:īurp Scanner cannot handle any authentication that is implemented on the endpoint level. If the API definition provides example sets of parameters, Burp Scanner uses the final provided example in its request.īurp Scanner can only scan API endpoints that meet certain criteria. If an endpoint uses numeric values, Burp Scanner uses the maximum and minimum values as specified. If an endpoint uses enumerated types, Burp Scanner sends a separate request for each of the parameter's permitted values. If an endpoint has optional parameters, Burp Scanner sends at least two requests to that endpoint: one containing only mandatory parameters and one containing both mandatory and optional parameters. For example, if a definition had three servers, each with GET and POST methods, then Burp Scanner would identify six endpoints. However, the crawler still needs to try a reasonable number of possible parameter combinations to make sure that it exposes all possible attack surfaces.Īs such, Burp Scanner sends requests in line with the following rules:īurp Scanner treats every combination of in-scope server and path methods (such as GET and POST) in the API definition as its own endpoint. In these cases, it would be impossible for the crawler to attempt all parameter combinations. For example, an open String parameter with no constraints would have a virtually unlimited number of potential valid inputs. ![]() Burp Scanner can then derive new locations to crawl and audit based on the endpoints that it discovers.ĭepending on the design of the API, each endpoint could have a huge number of potential parameters. When crawling an API definition, Burp Scanner sends a series of requests to identify potential endpoints, along with their supported methods and parameters.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |