Audit endpoints from an exposed Swagger or OpenAPI spec

Swagger Jacker takes an exposed API definition, a Swagger or OpenAPI file you found at a URL or pulled to disk, and turns it into an audit of the API it describes. A leaked spec lists every documented route, method, and parameter, a map an attacker would otherwise have to guess at. Swagger Jacker reads that map and exercises it instead of leaving it as a static document.

It runs in modes chosen by a command argument: list the endpoints declared in the spec, automate requests against each one, brute force a host to locate the definition file, convert the spec into a plain list of URLs, or prepare per-endpoint curl commands for manual testing. Rate limiting, custom headers, proxy support, and a configurable user agent let you drive the requests responsibly and route them through tooling like Burp. A safe-word option keeps flagged, potentially destructive operations from firing by accident.

On Trickest, Swagger Jacker is a Discovery-category node that takes a definition URL or local file and writes a file and a folder of results. Place it after you locate an exposed spec: discovery finds the definition file, Swagger Jacker enumerates and tests the routes it declares, and the findings land as a queryable output.