OpenAPI for Pentesters

A new approach for penetration Testers

During a pentest you often asked by the client if you need an OPENAPI specification? The next time you should say YES!
In order to understand why OPENAPI is relevant to pentesters, we must first understand what OPENAPI is and what it does.

What is OPENAPI?

OpenAPI is a specification that allows developers to describe the structure of their APIs. It is used by many large companies, such as Google, Microsoft, and Amazon.
This enables both humans and computers to discover and understand the capabilities of a service without access to source code, documentation, or through network traffic inspection.
When properly defined, a consumer can understand and interact with the remote service with a minimal amount of implementation logic.

OPENAPI is relevant to pentesters because it can be used to automatically generate test cases for APIs,also can be helpful for you pentester who are trying to understand the functionality of an API. This can be extremely useful for finding vulnerabilities in APIs that would otherwise be difficult to find.

As a result, OpenAPI has quickly become the de facto standard for describing REST APIs, and is therefore a natural fit for use in documenting and testing pentesting tools and techniques.

So I want to introduce our Swagger Tool https://www.blstsecurity.com.
The tool is design to give an understanding about the API, and provides information like which parameters exists, information about the parent endpoint etc.

Just drag and drop your OPENAPI file to our website.

The following image describe the result after upload the specification file.

I will dive deeper in my next history..