TLDR Tech / InfoSec
Meet Vespasian. It Sees What Static Analysis Can't
Vespasian is an open-source API endpoint discovery tool that captures live HTTP traffic via headless browser or existing Burp Suite, HAR, and mitmproxy captures, then generates structured specifications: OpenAPI 3.0 for REST, GraphQL SDL, and WSDL for SOAP. Its two-stage pipeline separates capture from generation, with confidence-scored heuristics for API type classification, path normalization with parameterized deduplication, and a tiered GraphQL introspection strategy that includes WAF bypass fallbacks. Vespasian integrates directly with Praetorian's Hadrian for automated BOLA/BFLA testing, forming a complete discover-then-test pipeline with no manual spec creation required.
Read the full story