APIsec as a API fuzzer
What middleBrick covers
- Black-box API scanning with read-only methods under one minute
- Detection of 12 OWASP API Top 10 categories including auth and LLM attacks
- OpenAPI 3.x and Swagger 2.0 parsing with recursive $ref resolution
- Authenticated scanning with header allowlist and domain verification
- Continuous monitoring with diff detection and email alert controls
- Programmatic access via CLI, API client, and MCP server integrations
APIsec as an API fuzzer: scope and intent
APIsec is positioned as a scanner that surfaces security issues in API endpoints rather than a pure fuzzer that generates and executes malformed payloads to find crashes. It focuses on detection aligned to the OWASP API Top 10, covering authentication bypass, injection-like patterns in header and parameter handling, and common configuration errors. The scanner uses black-box probes, sending only read-only methods plus text-based POST for LLM exposures, and does not attempt to mutate binary formats or protocol-level fuzzing.
Mapping to compliance and standards
middleBrick maps findings directly to three frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). Each finding references the relevant control or requirement to help you prepare audit evidence. For other regulations, the tool aligns with security controls described in HIPAA, GDPR, ISO 27001, NIST, CCPA, NIS2, DORA, FedRAMP, DPDP, APPI, PDPA, PIPEDA, PIPA, UK DPA, LGPD, SOX, GLBA, FERPA, and similar frameworks using alignment language only.
Detection capabilities and testing methods
The scanner runs targeted probes across 12 categories, including authentication misconfigurations, BOLA and BFLA, property over-exposure, input validation issues such as CORS wildcard and dangerous methods, rate limiting anomalies, and data exposure like PII patterns and API key formats. For LLM/AI Security, it executes 18 adversarial probes across Quick, Standard, and Deep tiers, testing for system prompt extraction, instruction override, jailbreak patterns, data exfiltration attempts, token smuggling, and multi-turn manipulation while remaining read-only.
OpenAPI analysis and authenticated scanning
middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution, cross-referencing spec definitions against runtime behavior to identify undefined security schemes, sensitive field exposure, deprecated operations, and missing pagination. Authenticated scanning supports Bearer, API key, Basic auth, and cookies, gated by domain verification through DNS TXT records or HTTP well-known files, with a strict header allowlist limited to Authorization, X-API-Key, Cookie, and X-Custom-* headers.
Limitations and what the scanner does not do
The tool does not fix, patch, block, or remediate findings; it reports with remediation guidance. It does not perform active SQL injection or command injection, which require intrusive payloads outside scope, nor does it detect business logic vulnerabilities or blind SSRF relying on out-of-band infrastructure. It is not a replacement for a human pentester in high-stakes audits.