Teycir/BurpAPISecuritySuite

What it is

BurpAPISecuritySuite's README, describing a single Burp extension that deliberately replaces "10+ separate extensions" and — beyond the fuzzing/OWASP-Top-10 coverage the summary lists — carries a distinct differential-first logic-testing layer and an evidence-driven verification workflow. It also names ApiHunter as a companion MIT-licensed recon tool (github.com/Teycir/ApiHunter). Funded by ETH donation, no licensing cost.

What the summary doesn't carry

The summary frames this as recon + fuzzing + payloads. The page's more distinctive claims are the non-destructive logic checks that don't rely on payload injection:

• Counterfactual Differentials — scoreless, non-destructive invariant breaks for representation/auth/identifier drift.
• Sequence Invariants — deep-logic checks with a confidence/evidence ledger export.
• Token Lineage Analysis — passive detection of logout/revoke/refresh rotation gaps in session lifecycle.
• Cross-Interface Parity & Drift — REST/GraphQL/internal auth parity gaps, cache/auth drift, time-window flips, content-type policy drift, and replay-after-delete leakage.
• OpenAPI Drift — observed traffic vs spec, to surface undocumented/missing endpoints.

And a verification loop, distinct from raw fuzzing output:

• SQLMap Verify — confirm SQLi candidates with evidence-driven sqlmap runs.
• Dalfox Verify — confirm reflected XSS candidates with Dalfox proof output.

How it works

A single Recon tab auto-captures HTTP/Proxy traffic and normalizes endpoints (/users/123 → /users/{id}); other tabs (Fuzzer, Auth Replay, Passive Discovery) share that dataset without re-parsing. The stated rationale for one extension over many: shared traffic context, one callback chain instead of multiplicative per-request overhead across extensions, lower memory, faster startup, fewer version conflicts. Optional Scope Filtering imports Burp's target scope so tool runs stay on in-scope hosts only.

What to do

Nothing to patch — this is a tool to install, not a vulnerability. If evaluating it, note the practical differentiators over a generic API fuzzer: it verifies findings through external tools rather than just emitting candidates, and its logic checks (auth parity, token rotation, replay-after-delete) are advertised as non-destructive, which matters for testing against sensitive or production-adjacent targets. Deep-search recon depends on the separately installed ApiHunter.

Caveats

This is the project's own README — all claims (memory/CPU benefits, detection quality, "108+ vectors") are unverified vendor statements, not independent benchmarks. The performance argument is architectural reasoning, not measured data. Several advanced features depend on external binaries being present (sqlmap, Dalfox, Nuclei, HTTPX, Katana, FFUF, subfinder, dnsx) and on the companion ApiHunter install.