๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ป๐ด ๐๐ฃ๐ ๐ฃ๐ฒ๐ฟ๐บ๐ถ๐๐๐ถ๐ผ๐ป ๐ง๐ฒ๐๐๐ถ๐ป๐ด ๐ฎ๐ป๐ฑ ๐ข๐ฝ๐ฒ๐ป๐๐ฃ๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐
Many teams move to microservices and use Swagger or OpenAPI to generate documentation. This speed often leads to a major mistake. Developers forget to control permissions. This turns your API into an open playground for attackers.
AutoSwagger is a tool built to fix this problem. It is an open-source Python CLI tool from Intruder. It finds, reads, and tests API endpoints to find broken authorization.
Developers often add authentication but forget authorization. They also leave shadow APIs unprotected.
How AutoSwagger works:
- Discovery: It scans URLs to find swagger.json or openapi.yaml files.
- Parsing: It reads the API specs to understand parameter types like strings or UUIDs.
- Fuzzing: Using brute force mode, it tries different values to bypass simple logic.
- Testing: It sends requests to see if unauthenticated users get a 200 OK response.
- PII Detection: It uses NLP to find sensitive data like emails or credit card numbers in the response.
Think of it as an automated robot for API testing. It finds the spec, builds an attack surface, sends payloads, and analyzes the results for leaks.
You might think your API is safe because it is in a private network or uses JWT. But did you add a verifyToken middleware to every single endpoint? Did you forget a GET /admin/config path? AutoSwagger checks if you think you locked the door but actually left it open.
Quick setup:
- Clone the project.
- Create a virtual environment.
- Install requirements.
You can run a scan with a single command: python3 autoswagger.py [URL] -v -json
If an endpoint like GET /api/v1/users/recent returns a 200 OK without a token, the tool flags it. It can even find leaked AWS keys or phone numbers in the data.
How to stay safe:
- Block paths like /swagger-ui.html or /openapi.json in your production K8s Ingress.
- Keep Swagger only in Dev or Staging environments.
- Apply authentication at the API Gateway or global middleware level instead of every single controller.
- Use an allowlist for public endpoints like Login.
- Add AutoSwagger to your CI/CD pipeline to scan every deployment.
Security flaws often come from human error. Automation helps you catch these mistakes before they become breaches.
Source: https://dev.to/jh5_pulse/zi-dong-hua-ce-shi-api-quan-xian-lou-dong-yu-openapi-an-quan-xing-396f
Optional learning community: https://t.me/GyaanSetuAi