During API penetration testing, one of the biggest challenges is identifying every available endpoint. Many organizations do not maintain accurate Swagger or OpenAPI documentation, forcing security testers to manually collect requests from Burp Suite before actual testing can begin.
To simplify this process, I developed API Discovery Pro, an open-source Burp Suite extension that automatically captures API endpoints from live HTTP traffic and generates an OpenAPI (Swagger) specification for further testing.
Why I Built API Discovery Pro
Throughout my penetration testing engagements, I repeatedly encountered the same problem:
- API documentation was missing or outdated.
- Endpoints had to be collected manually.
- Duplicate requests consumed valuable testing time.
- Generating Swagger files required additional tools or scripts.
I wanted a lightweight Burp Suite extension that could automate endpoint discovery while allowing security professionals to focus on finding vulnerabilities instead of documenting APIs.
Key Features
- Automatically discovers API endpoints from Burp Suite traffic.
- Live dashboard showing captured hosts, endpoints, and requests.
- Endpoint table with HTTP methods and hit counts.
- Generate OpenAPI (Swagger) specifications.
- Copy generated specifications to clipboard.
- Export Swagger/OpenAPI JSON files.
- Clean and lightweight user interface.
How It Works
The workflow is intentionally simple.
- Install the extension in Burp Suite.
- Browse or test the target application.
- API Discovery Pro automatically captures API requests.
- Review discovered endpoints.
- Generate an OpenAPI specification.
- Export or copy the generated Swagger JSON.
Instead of spending hours documenting APIs manually, testers can generate a usable API specification in just a few clicks.
Who Is This Tool For?
- Penetration Testers
- Bug Bounty Hunters
- Application Security Engineers
- Red Team Operators
- Developers documenting legacy APIs
- API Security Researchers
Current Features
- Dashboard overview
- Endpoint discovery
- Swagger generation
- Clipboard export
- JSON export
- Duplicate endpoint handling
Future Improvements
API Discovery Pro is actively being developed. Planned improvements include:
- Request parameter extraction
- Response schema generation
- Authentication detection
- Better filtering capabilities
- OpenAPI 3.x enhancements
- Support for GraphQL endpoints
- Improved API grouping
GitHub Repository
The project is completely open source, and contributions are always welcome. If you would like to try the extension, report issues, or contribute new features, visit the GitHub repository:
https://github.com/mesbah-diu/API-Discovery-Pro
Final Thoughts
API reconnaissance is one of the most important phases of API security testing. Missing endpoints often mean missed vulnerabilities. API Discovery Pro was built to automate this repetitive process and help penetration testers spend more time identifying security issues rather than documenting APIs.
I hope this project becomes a useful addition to the security community. Feedback, feature requests, and contributions are always appreciated.
Md. Mesbaul Islam
Penetration Tester | Security Researcher | Open Source Contributor