API

Autoswagger: Automate API Security Testing for Unauthenticated Endpoints (Free & Open-source)

Hazem Abbas

27 Jul 2025 — 3 min read

What is Autoswagger?

Autoswagger is a command-line tool focused on API security testing. It automatically discovers, parses, and tests endpoints defined in Swagger/ OpenAPI documentation for common vulnerabilities.

Its primary goal is to identify unauthenticated API endpoints that might be leaking sensitive information like Personally Identifiable Information (PII) or secrets.

It works by finding the API specification (via direct URL, Swagger UI, or common paths), extracting the endpoints, and then testing them, often concurrently, for potential security issues.

While still under heavy development, it offers a useful starting point for automated API reconnaissance and vulnerability detection.

Features

Features List:

Swagger/OpenAPI Discovery:
- Parses specifications directly from a provided URL ending in .json, .yaml, or .yml.
- Extracts specifications from Swagger UI pages (e.g., /swagger-ui.html).
- Attempts brute-force discovery using common OpenAPI schema file locations (e.g., /swagger.json, /openapi.json).
Automated Endpoint Testing:
- Systematically tests discovered API endpoints for vulnerabilities.
- Supports parallel, multi-threaded testing of endpoints.
- Includes configurable rate limiting (-rate).
Parameter Brute-Forcing:
- Option (-b or --brute) to test endpoints with example values for parameters, attempting to bypass validation.
PII Detection:
- Integrates Presidio for identifying PII like phone numbers, emails, addresses, and names.
- Includes context validation to reduce false positives.
- Parses PII from CSV rows and simple "key: value" formatted lines.
Secrets Detection:
- Uses regex patterns to identify exposed tokens, keys, and debugging artifacts (like environment variables).
Response Analysis:
- Flags large or potentially interesting API responses.
Flexible Output:
- Default table format for easy reading.
- JSON output option (-json).
- Filtered output mode (-product) showing only results with PII, secrets, or large responses.