Q: For feeding Swagger spec to 'sqlmap' SQL injection tool, what parser is better?

[rrjanbiah]

Q&A

Context: sqlmapproject/sqlmap#3140

Popular sqlmap SQL injection tool developer seems to need some support in shortlisting good Swagger parser. Basically, users (including myself) have requested something like below:

python sqlmap.py --swagger-uri https://petstore.swagger.io/v2/swagger.json (Meaning, if swagger spec is passed, it has to parse it and simulate SQL injection vectors on all API endpoints)

But, the developer seems to have some difficulty in figuring out the right parser or sdk for the purpose. Can someone share few thoughts here? TIA

Content & configuration

n/a

Swagger/OpenAPI definition:

n/a

Swagger-UI configuration options:

n/a

Screenshots

n/a

How can we help?

Possibly share your experience and or your recommended Swagger parser for the above use case.

[shockey]

Hi @rrjanbiah, this tracker is for Swagger UI-specific items, not general Swagger/OpenAPI questions.

Consider posting on Stack Overflow instead 😄