API Scanning with Burp Suite

Summary: PortSwigger adapted Burp Scanner's crawler to work with API endpoints rather than web pages, parsing OpenAPI documents to find exposed endpoints and pass them to the scanner. The team built a separate APIDoorway rather than reusing HTML form handling, because OpenAPI Boolean parameters default to false when omitted and other data types behave differently, and added the ability to submit JSON request bodies.
Bottom line: APIs are often overlooked by security teams because they are used only by developers and machines, and the crawler cannot try every combination of an unconstrained String parameter, so it falls back to a limited set of parameter combinations to expose attack surfaces.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026