Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Security assessment of few REST APIs using BurpSuite Pro

Whitehaat | Last updated: Mar 07, 2018 11:31AM UTC

I need to do security assessment of few REST APIs and I have BurpSuite Pro tool. 1. If I setup the burp proxy on browser to capture all request / response and scan, is BurpSuite Pro capable of identifying the vulnerabilities in REST APIs? 2. Is scanning similar to web applications? OR are there any other settings do need to do to discover vulnerabilities in REST APIs?

Liam, PortSwigger Agent | Last updated: Mar 07, 2018 11:43AM UTC

Burp can test any REST API endpoint, provided you can use a normal client for that endpoint to generate normal traffic. The process is to proxy the client's traffic through Burp and then test it in the normal way. - https://support.portswigger.net/customer/portal/articles/2898121-using-burp-to-enumerate-a-rest-api - https://support.portswigger.net/customer/portal/articles/2898216-using-burp-to-test-a-rest-api Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.