Skip to content

API Testing Hotstart

Scan efficiency and precision can be enhanced through the Hotstart feature, which provides the scanner with legitimate requests and supplementary URLs. This additional context enables deeper analysis of API endpoints and business logic, resulting in more comprehensive security testing.

Operations to be executed at scan initialization are defined under the hotstart configuration key. Multiple requests can be specified to establish necessary application state.

GraphQL Hotstart

For GraphQL applications, only the GraphQL document is required to declare operations that will be executed at the beginning of the scan.

graphql_api_dast:
  hotstart:
  - 'query { child(parentId: "00000000-0000-0000-0000-000000000000" ) { id name birthdate } }'
  - 'query { bank(account: 1337) { id address } }'

GraphQL Documents Are Sent as Written

Escape sends each GraphQL document in hotstart as you wrote it. It doesn't need to match an operation name generated from the schema. Those generated names change when the schema changes, so paste the query you want the API to receive.

A mutation in this list runs at the start of the scan. A read-only scan, or an operation outside the configured scope, skips that hotstart. The scan log shows a warning with the reason, and the rest of the scan continues.

An entry that isn't a GraphQL document or a curl command is skipped the same way.

REST Hotstart

For REST applications, the hotstart is configured as a list of curl commands to be executed sequentially. A command is sent even when its URL isn't in the schema. Out-of-scope requests, and writes during a read-only scan, are skipped with a warning in the scan log.

rest_api_dast:
  hotstart:
  - 'curl https://example.com/users'
  - 'curl https://example.com/users -H "Authorization: Bearer <token>" -X POST -d "{\"name\": \"John\"}"'

Limit Exploration to Hotstart

Both API configurations support hotstart_only, which defaults to false. Set it to true to use only the supplied hotstart queries:

rest_api_dast:
  hotstart:
    - 'curl https://api.example.com/users'
  hotstart_only: true