# shuanx/BurpAPIFinder

攻防演练过程中，我们通常会用浏览器访问一些资产，但很多未授权/敏感信息/越权隐匿在已访问接口过html、JS文件等，该插件能让我们发现未授权/敏感信息/越权/登陆接口等。

Repository: https://github.com/shuanx/BurpAPIFinder
Canonical: https://ross.abutalabs.com/products/burpapifinder
Language: Java
License Family: other
Last push: 2024-10-03T02:10:22+00:00

## Health v2 (maintenance only)
Score: 15/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 62
- inputs: {"age_days": 881, "days_push": 700, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1472, forks 78 (observed 2026-08-28T04:04:49.393264+00:00)

## What it is
BurpAPIFinder is a Burp Suite extension written in Java that passively analyzes HTTP traffic (HTML and JS files) to discover hidden API endpoints, sensitive information leaks, and unauthorized/privilege-escalation access points. It integrates fingerprint libraries from HaE, APIKit, and sweetPotato, and supports active endpoint probing with customizable sensitive keywords.

## Use cases
- find sensitive information leaked in javascript files during a pentest
- discover unauthorized API endpoints that expose credentials
- detect leaked cloud access keys and secret keys in web traffic
- enumerate user information or password change endpoints
- find hidden admin backend login URLs
- extract and probe API paths from JS files during red team engagements

## When to choose
- you are doing offensive security work or red team exercises with Burp Suite
- you want passive sensitive-info detection integrated into your proxy traffic
- you need a free alternative combining HaE, APIKit, and sweetPotato fingerprints

## When to avoid
- you need a standalone scanner outside Burp Suite
- you require a maintained project with a formal license for compliance-sensitive environments
- you need non-JVM tooling or CI-based automated scanning

## Facets
- artifact type: plugin
- maturity: active
- function: security, vulnerability-scanning, web-scraping, developer-tools
- domain: security, penetration-testing, web-development, browser-extensions
- platform: jvm
- tags: burp-suite-extension, sensitive-information-detection, unauthorized-access, api-discovery, offensive-security, red-team, burp-suite

## Member repositories
- shuanx/BurpAPIFinder (main) score 15

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:49.393264+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:34:43.806597+00:00, confidence not recorded.
  - readme: https://github.com/shuanx/BurpAPIFinder (fetched 2026-08-28T04:04:49.393264+00:00, sha d60f59f4a214)
- Data as of 2026-08-30T08:39:29.467469+00:00.