AutoExploitSwagger is an automated API security testing exploit tool that can be combined with xray, BurpSuite and other scanners.

Last update: Jan 28, 2022

Related tags

Testing AutoExploitSwagger

Overview

Swagger API自动化利用工具

AutoExploitSwagger 是一款可以跟xray，BurpSuite等扫描器结合的自动化API安全测试利用工具。可以在日常安全检查或者利用Swagger信息泄漏的场景下使用。

下载

git clone https://github.com/wyzmlr/AutoExploitSwagger.git

安装

cd AutoExploitSwagger/
pip install -r requirements.txt
python start.py -h

使用帮助

python start.py -h

Swagger API 自动化扫描工具

optional arguments:
  -h, --help            show this help message and exit
  -u TARGET_URL, --url TARGET_URL
                        swagger api地址
  -i PROXY_IP, --ip PROXY_IP
                        proxy ip
  -p PROXY_PORT, --port PROXY_PORT
                        proxy port
  -f URL_FILE, --file URL_FILE
                        批量测试
                        
  Note:
    -u 参数为必选项
    -t 默认10个线程

功能特性

自定义header
- 一般用于接口需授权（企业安全测试场景下可获取测试token后测试）
扫描结果汇总
- 结果和日志路径在settings.py里配置
代理扫描
- 设置xray或burpsuite代理地址即可自动化扫描
批量检测
- 导入存在swagger api泄漏的地址（例：http://x.x.x.x/api/doc，注意格式不要写错）
多线程
- 默认10个，可自定义
TODO

Example 有什么好的想法欢迎提issue～

AutoExploitSwagger is an automated API security testing exploit tool that can be combined with xray, BurpSuite and other scanners.

Related tags

Overview

Swagger API自动化利用工具

功能特性

Owner

Connexion-faker - Auto-generate mocks from your Connexion API using OpenAPI

✅ Python web automation and testing. 🚀 Fast, easy, reliable. 💠

An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account - or share the resources with the entire internet 😈

pytest plugin that let you automate actions and assertions with test metrics reporting executing plain YAML files

Getting the most out of your hobby servo

Fail tests that take too long to run

To automate the generation and validation tests of COSE/CBOR Codes and it's base45/2D Code representations

BDD library for the py.test runner

Automatically mock your HTTP interactions to simplify and speed up testing

This is a Python script for Github Bot which uses Selenium to Automate things.

Cloint India Pvt. Ltd's (ClointFusion) Pythonic RPA (Automation) Platform

Python drivers for YeeNet firmware

A modern API testing tool for web applications built with Open API and GraphQL specifications.

AutoExploitSwagger is an automated API security testing exploit tool that can be combined with xray, BurpSuite and other scanners.

1st Solution to QQ Browser 2021 AIAC Track 2

FaceBot is a script to automatically create a facebook account using the selenium and chromedriver modules.

Codeforces Test Parser for C/C++ & Python on Windows

Docker-based integration tests

Python script to automatically download from Zippyshare

Data-Driven Tests for Python Unittest