{"id":14637890,"url":"https://github.com/shuanx/BurpAPIFinder","last_synced_at":"2025-09-07T06:31:10.112Z","repository":{"id":231458846,"uuid":"781781476","full_name":"shuanx/BurpAPIFinder","owner":"shuanx","description":"攻防演练过程中，我们通常会用浏览器访问一些资产，但很多未授权/敏感信息/越权隐匿在已访问接口过html、JS文件等，该插件能让我们发现未授权/敏感信息/越权/登陆接口等。","archived":false,"fork":false,"pushed_at":"2024-04-19T01:22:52.000Z","size":5046,"stargazers_count":20,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-04-19T01:24:20.136Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shuanx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-04-04T02:52:42.000Z","updated_at":"2024-04-20T04:33:35.651Z","dependencies_parsed_at":"2024-04-20T04:33:30.619Z","dependency_job_id":"cdbccc2f-1205-4913-827c-ad50ad2a8301","html_url":"https://github.com/shuanx/BurpAPIFinder","commit_stats":null,"previous_names":["shuanx/burpjsurlfinder","shuanx/burpapifinder"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/shuanx/BurpAPIFinder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuanx%2FBurpAPIFinder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuanx%2FBurpAPIFinder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuanx%2FBurpAPIFinder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuanx%2FBurpAPIFinder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shuanx","download_url":"https://codeload.github.com/shuanx/BurpAPIFinder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuanx%2FBurpAPIFinder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274005341,"owners_count":25205934,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-10T02:01:23.270Z","updated_at":"2025-09-07T06:31:09.642Z","avatar_url":"https://github.com/shuanx.png","language":"Java","funding_links":[],"categories":["Java","burpsuite插件"],"sub_categories":[],"readme":"# BurpAPIFinder\n![](https://img.shields.io/badge/Author-Shaun-blue)\n![](https://img.shields.io/badge/JDK-9+-yellow)\n![](https://img.shields.io/badge/捡漏是门艺术-往往有意想不到的成果-red)\n\u003e 攻防演练过程中，我们通常会用浏览器访问一些资产，但很多未授权/敏感信息/越权隐匿在已访问接口过html、JS文件等，通过该BurpAPIFinder插件我们可以：  \n\u003e 1、发现通过某接口可以进行未授权/越权获取到所有的账号密码、私钥、凭证  \n\u003e 2、发现通过某接口可以枚举用户信息、密码修改、用户创建接口  \n\u003e 3、发现登陆后台网址  \n\u003e 4、发现在html、JS中泄漏账号密码或者云主机的Access Key和SecretKey  \n\u003e 5、自动提取js、html中路径进行访问，也支持自定义父路径访问\n\u003e ...  \n\n![img.png](images/main.png)\n\n## 功能如下\n\u003e 如果有更好的建议或者期待使用的，点个免费的Star\n- [x] 提取网站的URL链接和解析JS文件中的URL链接(不单单正则、支持多种模式提取)\n- [x] 前段界面可自行定义敏感关键词、敏感url匹配\n- [x] 界面可配置的开启主动接口探测、敏感信息获取  \n- [x] 支持用户自定义父路径重新开发扫描任务\n- [x] 集成主流攻防场景敏感信息泄漏的指纹库  \n![img.png](images/config.png)\n- [x] 集成HaE的敏感信息识别指纹\n- [x] 集成APIKit的敏感信息识别指纹\n- [x] 集成sweetPotato的敏感信息识别指纹\n\n## 使用说明\n1、下载右侧Releases下的jar包  \n2、如原先有使用旧版本的，需要删除掉原先同BurpAPIFinder.jar同目录下的BurpAPIFinder.db和finger-tmp.json文件后再加载\n3、加载完后，不需要任何其他配置，只需要你在访问的网站的BurpSuite的代码，就会进行敏感指纹识别，有空去看看该网站看有没有匹配到铭感信息即可S\n\n## 功能介绍\nhttps://note.youdao.com/s/LGwO5Dmw\n\n## 闲聊/优化/建议/问题反馈群\n\u003cimg src=\"images/weixinqun.png\" alt=\"img.png\" width=\"200\"/\u003e\n\n## BurpFingerPrint\n额外推荐笔者另一个好用的插件 BurpFinderPrint\nGITHUB: https://github.com/shuanx/BurpFingerPrint\n该插件为作者精心开发出来, 旨在打造最强免费指纹识别库和弱口令探测库\n\n\n## 免责声明\n\n本工具仅作为安全研究交流，请勿用于非法用途。如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，本人将不承担任何法律及连带责任。\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuanx%2FBurpAPIFinder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshuanx%2FBurpAPIFinder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuanx%2FBurpAPIFinder/lists"}