Setting up an API pentesting environment
- Tutorials
- by Jacob Riggs
- 04-02-2023
This is my go-to reference documentation for setting up a fresh dedicated API pentesting environment within Kali.
Setting up Burp
- Download Jython
Head over to https://www.jython.org/download.html and download the latest Jython standalone installer.
- Set the Python Environment path
Set the downloaded Jython installer as the Python Environment path.
- Install the Autorize extension
Within Burp, navigate to Extender > BApp Store > search for Autorize and install the extension.
Install FoxyProxy
With Firefox open, press Ctrl + Shift + A to open the add-ons menu.
- Search for FoxyProxy Standard
- Add FoxyProxy to Firefox
- Navigate to FoxyProxy options
- Add Burp to FoxyProxy
- Add Postman to FoxyProxy
Configure Burp Suite Certificate
- Start Burp
- With Burp Suite enabled in FoxyProxy, navigate to http://burpsuite and click the CA Certificate to download the certificate.
- In Firefox, open Preferences and use the search bar to look for certificates. Import the downloaded certificate.
- In Chrome, open Settings > Privacy and security > Certificates managed by Chrome and import the downloaded certificate (may need to change the file type options to 'All Files').
Postman
- Download Postman
sudo wget https://dl.pstmn.io/download/latest/linux64 -O postman-linux-x64.tar.gz
- Extract and install Postman
sudo tar -xvzf postman-linux-x64.tar.gz
- Link the postman command
sudo ln -s ~/Postman/Postman /usr/bin/postman
mitmproxy2swagger
- Install mitmproxy2swagger
sudo pip3 install mitmproxy2swagger
Git
- Install Git
sudo apt install git
Docker
- Install Docker
sudo apt install docker-compose
sudo apt install docker.io
Golang
- Install Golang
sudo apt install golang-go
At this point a restart may be required.
JWT Tool
- Pull down the JWT Tool repo
sudo git clone https://github.com/ticarpi/jwt_tool.git
- Install JWT Tool
cd jwt_tool
python3 -m pip install termcolor cprint pycryptodomex requests
sudo chmod +x jwt_tool.py
sudo ln -s ~/jwt_tool/jwt_tool.py /usr/bin/jwt_tool
Kiterunner
- Pull down the Kiterunner repo
sudo git clone https://github.com/assetnote/kiterunner.git
- Install Kiterunner
cd kiterunner
sudo make build
cd dist
sudo ln -s ~/kiterunner/dist/kr /usr/bin/kr
Arjun
- Pull down the Arjun repo
sudo git clone https://github.com/s0md3v/Arjun.git
- Install Arjun
cd Arjun
sudo python3 setup.py install
ZAProxy
- Install ZAProxy
sudo apt install zaproxy
- Update OpenAPI add-on