Alternatives to 42Crunch for New endpoint auto-discovery scan
What middleBrick covers
- Black-box endpoint discovery without agents or code access
- Risk scoring with prioritized findings mapped to OWASP API Top 10
- OpenAPI 3.x and Swagger 2.0 spec parsing with $ref resolution
- Authenticated scans with strict header allowlists and domain verification
- CI/CD integration via GitHub Action and programmatic API
- Continuous monitoring with diff detection and scheduled rescans
Black-box scanning for endpoint discovery
middleBrick is a self-service API security scanner that performs black-box testing without requiring agents, SDKs, or code access. Submit a target URL and receive a risk score from A to F with prioritized findings. The scanner operates with read-only methods, including GET and HEAD, plus text-only POST for LLM probes. Scan completion typically occurs in under a minute, making it practical for continuous checks during development and pre-deployment phases.
Detection aligned to OWASP API Top 10 and related mappings
The scanner covers 12 security categories aligned to OWASP API Top 10 (2023). It detects authentication bypasses, JWT misconfigurations such as alg=none or expired tokens, BOLA and IDOR via sequential ID enumeration, BFLA and privilege escalation attempts, and property over-exposure. Additional categories include input validation issues like CORS wildcard usage, rate limiting and resource consumption signals, data exposure patterns including PII and API keys, encryption misconfigurations, SSRF indicators, and inventory management gaps. An LLM security tier probes for prompt injection, jailbreak techniques, and data exfiltration paths.
OpenAPI spec analysis and authenticated scanning
middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution. It cross-references spec definitions against runtime behavior to identify undefined security schemes, sensitive field exposure, deprecated operations, and missing pagination. For authenticated scans, supported methods include Bearer tokens, API keys, Basic auth, and cookies. Domain verification is enforced through DNS TXT records or HTTP well-known files, and the scanner only forwards a strict allowlist of headers to limit exposure.
Product features and integration options
The Web Dashboard centralizes scan management, report viewing, score trend tracking, and downloadable compliance PDFs. The CLI, distributed as an npm package, supports commands such as middlebrick scan <url> with JSON or text output. A GitHub Action can enforce CI/CD gates by failing builds when scores drop below configured thresholds. An MCP Server enables scanning from AI coding assistants, and a programmatic API supports custom integrations. Pro tier adds scheduled rescans, diff detection, email alerts, and signed webhooks.
Data handling, safety posture, and limitations
middleBrick follows a read-only safety posture, never sending destructive payloads. Internal infrastructure, private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Customer scan data is deletable on demand and purged within 30 days of cancellation. The tool does not fix, patch, or block findings; it reports with remediation guidance. It does not perform active SQL injection or command injection testing, detect blind SSRF, or replace a human pentester for high-stakes audits.