API Discovery (OpenAPI/WSDL/Kiterunner)

[TheTechromancer]

Having a module to detect the presence of APIs (and especially unauthenticated endpoints) would be very valuable. Suggested by @pjhartlieb.

@liquidsec you may have some thoughts on this. I think a simple swagger/WSDL detector could probably fit into web-basic, whereas something like Kiterunner would probably be in web-thorough.

Detect Spring Boot available endpoints:
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/technologies/springboot-actuator.yaml

[domwhewell-sage]

I could probably have a look into this it would be similar to the postman module watching DNS_NAME events and outputting URL_UNVERIFIED events.

They would probably be quite short modules with a list of common paths and use the helpers.request to flag any that respond with HTTP 200

[TheTechromancer]

Sweet! Yeah, at least with WSDL and Swagger/OpenAPI, they should give all or most of the information you need to send a request to each endpoint.

[TheTechromancer]

You could probably plagiarize a bit from Burpsuite's wsdler and openapi-parser.

There are also some python libraries that do this type of thing

• https://github.com/mvantellingen/python-zeep
• https://github.com/pyopenapi/pyswagger

[domwhewell-sage]

So would you envision this parsing the API spec and sending an unauthenticated request to any endpoints that are defined? Or just passing the Swagger/wsdl URL to excavate?

Or both? I'm happy with either.

[TheTechromancer]

Hmm yeah I think for this, the module itself would need to send the request. The reason is because most of the time the URL alone wouldn't be enough, since you'd also need to fill out the request body with each endpoint's required params.