BurpSuite: create an API scan and solving common errors
Burp Suite is a powerful and widely used platform for web security testing, developed by PortSwigger. It’s a favorite among security professionals, ethical hackers, and penetration testers for assessing web application vulnerabilities.
Burp is used a lot to scan web sites, but can also be used to scan APIs, this article is about common issues when setting up an API scan.
In order to scan an API we create a new API scan, as outlined in the official documentation, also you can check other good guides as this
If your API is developed using .NET platform probably you are using swagger to export API specification, it is important to know that swagger becomes OPEN API specification, so the swagger.json is an open api specification as required by the burp suite.
You can provide the swagger.json url, but if you have the need to edit endpoints or make changes for disabling some endpoints, there is also the option to upload the api definition directly from a file:
ERROR “No server URLs found”
As you upload the definition it is possible you encounter with the “No server URLs found” ERROR:
In this case what you need to do is to add a servers property to the main object in the json, this property is an array of objects, each object represents a server, and should have the property url.
Get Alfonso Baqueiro Bernal’s stories in your inbox
Join Medium for free to get updates from this writer.
In this case you need to add a property servers to the object:
ERROR “Ilegal character in fragment at index”
After you fix that error and load again you can encounter with another kind of errors. Fragment refers to a part of a URL, in this case is all the characters that appear after the # char.
The root cause of this issue is that the java class that validates the url checks that only accepted characters are used, while the dotnet json exporter implementation does not matter and produces invalid characters for the fragments.
To fix this is a little bit more tricky but replacing the not so standard characters in the fragments with only _ can do the trick, to do this I writed a simple script to do the replacement, you can use it if you like it or write your own.
After that, when you load the file into Burp you will get a view with detail of the methods available in the API.
You can select what method to include in the scan using the UI checkboxes.
And that’s it, how can you fix this common errors when using Burp Enterprise suite for API scans.
If you find this useful don’t be shy and clap your hands. Thanks for reading.
