identify swagger endpoint

Question

identify swagger endpoint

eugui opened this issue 4 years ago · comments

Hi,

I have this code:

    {
        "vulnerability": "Swagger API Panel",
        "method": "GET",
        "color": "blue",
        "body": "",
        "endpoint": [
            "/swagger/index.html",
            "/swagger-ui.html",
            "/swagger/swagger-ui.html",
            "/api/swagger-ui.html",
            "/api-docs/swagger.json",
            "/swagger.json",
            "/swagger/v1/swagger.json",
            "/docs",
            "/docs/"
        ],
        "headers": [],
        "checkIn": "responseBody",
        "checkFor": "<title>Swagger UI"
    }

and I have an endpoint vulnerable: https://xxx.com/docs/

when I access this endpoint the response is:

<!-- HTML for static distribution bundle build -->
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Swagger UI</title>
  <link href="//fonts.googleapis.com/css?family=Open+Sans:400,700|Source+Code+Pro:300,600|Titillium+Web:400,600,700" rel="stylesheet">
  <link rel="stylesheet" type="text/css" href="swagger-ui.css">
  <link rel="icon" type="image/png" href="favicon-32x32.png" sizes="32x32" />
  <link rel="icon" type="image/png" href="favicon-16x16.png" sizes="16x16" />
  <style>

I would like to know why inception can not detect.

obs: the swagger is only available in /docs/ and not in /docs.