3 ms·
Show HN: Openapi.security, a fast security checker for REST-based API
tl;dr we released openapi.security, an online tool that performs a dozen of security tests on any given openapi/swagger-based API, with no signup or email required. You can try it here: https://openapi.security https://openapi.security
My team at Escape (YC W23) is mainly focused on securing GraphQL APIs. For this, we developed a new approach called Feedback driven API Exploration.
Basically, we infer the right security tests cases to run using the specification and a carefully crafted in house graph traversal algorithm. (It's a bit long to describe here but we published a more in depth explanation of how this algorithm works in our blog!)
We recently wondered if this Feedback Driven Exploration approach could be efficiently applied to good old REST APIs as well. From our experience, well designed GraphQL and REST APIs are quite equivalent: both have an organized data structure and explicit relationships between objects. So why wouldn't it work?
We often organise internal hackathons. So this time, we focused on this experiment, adapting our algorithm to REST and ending up creating our last side project: OpenAPI.security.
It is a very simple tool: anybody can enter an OpenAPI / Swagger spec, and openapi.security will run a bunch of security tests on it and give back a report. It's designed to be fast and smart in the way it analyzes input specs.
- MintsInc 4y agoLooks nice, is there a way to test a local api ?
- gauben 4y agoHey there, Escape dev here! This project follows the steps of graphql.security, our fast and free graphql API scanner, check it out if you use graphql rather than swagger/openapi
- iCarossio 4y agoHey folks, co-author here. This is in Beta and there is still a lot of work ahead. We are ready for feedback :)
- Dribble4633 4y agoCan I test my dev API ?
- iCarossio 4y agoYou mean locally?
- Dribble4633 4y agoYup, thx @nohehf
- nohehf 4y agoYep! Just ngrok your api port, start a scan on your spec and it will ask you to enter your server url (or you can pass them in the servers array of the spec). If you need any help lmk!
- sophieblo 4y agoReally handy this online scan tool! It detected an unauthenticated POST route on my API!
- iCarossio 4y agoHope this was the login route haha
- spQKL 4y agoAwesome ! I tried and saw grey checks. How can I manage to activate unauthenticated route detection ?
- swan_escape 4y agoGrey tint checks means that your api is secured. :)
- steffthestunter 4y agoSeems like a nice tool! Just a quick question, I do run some authenticated endpoints and would like to have them scanned. How can I achieve that with this scanner ?
- iCarossio 4y agoWe plan to support authenticated APIs through headers soon. Stay tuned on our Discord https://discord.escape.tech/ https://discord.escape.tech/
- Patescape 4y agoThis is next level, can I really scan any API ?
- helb 4y agoMy schema breaks it somehow, the POST request to openapi.prod.scanner.cloud.escape.tech/fast returns a 502 after ~20s: https://i.vgy.me/D14u3k.png https://i.vgy.me/D14u3k.png
- nohehf 4y agoHey! We're sorry for that, we were most likely deploying when you tried it out... You can retry it if you want and if you still have issue i'll be glad to help: https://discord.gg/G9FEuFuKfd https://discord.gg/G9FEuFuKfd