API Discovery

Overview

The Problem

80% of REST APIs are undocumented or poorly documented. This also means that 80% of REST APIs are not undergoing security testing since all quality API Security testing tools require a robust OpenAPI Spec (aka Swagger doc) to gain awareness of how to interact with the API and perform tests. However, creating Swagger docs from code requires knowledge of how the code works. Typical strategies include modifying the code to insert code comments, annotations, and decorators and leveraging 3rd party dependencies. If you didn’t write the code, this is time-consuming and difficult.

The Solution

To remove this friction and enable thorough API Security testing against more APIs, NightVision built a static analysis engine focused on API Discovery from the ground up. It requires zero code modifications and does not require a running application or code compilation—no solution on the market today does this. Our tool performs static analysis of source code and leverages framework-specific knowledge to create the OpenAPI specification.

Why does this matter?

Testing undocumented REST APIs with API Discovery

This helps NightVision perform testing on undocumented REST APIs. Even for a REST API with existing documentation, NightVision often finds endpoints not declared in the existing Swagger docs, allowing NightVision to achieve higher coverage.

Code Traceback

NightVision’s API Discovery feature enables tracing vulnerabilities back to the code origin. When NightVision scans code, it also annotates the Swagger doc with the file path and origin in the code in which endpoints are declared. When exploitable vulnerabilities are discovered with NightVision DAST, NightVision can surface these results in GitHub Security Alerts and tie the DAST findings back to the code origin.

Tracing DAST Results to the code origin in GitHub Security Alerts.

Too often, developers look at code scanning alerts in GitHub or GitLab and ignore them completely - because the results are not exploitable.

Developers tend to react differently to NightVision’s code scanning alerts because NightVision verifies exploitability. NightVision tells the developer exactly how the vulnerability was exploited.

In the case below, NightVision explains to the developer that NV sent the payload ' to the searchText request parameter in a POST request and getting org.postgresql.util.PSQLException in the response.

Surfacing exploitable vulnerabilities in GitHub Security Alerts - right in the developer's workflow.

Language/Framework Support

For more details about supported frameworks, see the Framework Support Index, or visit the details about each language below:

C# ▶ Go ▶ Java ▶ JavaScript ▶ PHP ▶ Python ▶ Ruby ▶

Tutorial

Try out the API Discovery tutorial:

API Discovery Tutorial ▶