Find security gaps in your APIs before attackers do.
What it does
Identifies API security weaknesses and produces findings with severity ratings, reproduction steps, and remediation guidance.
When to use it
Use for API authorization, injection, business-logic, gateway-protection, and data-exposure assessments, with written authorization and appropriate production safeguards.
How to use it
Give it an authorized API target and credentials; it returns security findings with severity scores and code-level remediation guidance.
What you provide
- the API base URL
- API version information
- API credentials
Good to know
- cannot be undone: target API
What you need · 4
Requires Burp Suite Professional configured to intercept API traffic and handle JSON/XML content types.
Uses the Autorize extension to automate authorization testing by replaying requests with attacker and victim sessions.
Access · 2
This skill
target API
Sends potentially destructive API requests (irreversible)
cloud metadata endpoints
Probes cloud metadata through SSRF