Scanning APIs - Port Swigger
Summary: PortSwigger's documentation describes how Burp Suite DAST scans APIs added by file upload or URL, supporting Postman Collections with optional environment files, captured traffic in Burp XML or HAR format, and GraphQL APIs with introspection enabled. It states full support for OpenAPI 3.1 and provisional support for OpenAPI 3.2, and notes the scanner automatically detects authentication schemes except from recorded headers in Burp XML files.
What's compelling: The tooling assumes you can enumerate your APIs in a definition file or captured traffic, so any API your teams never documented or recorded simply won't be in the scan - and the one gap called out, authentication headers in Burp XML files, is exactly where credentials and access paths hide.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026