🔐 Authz-ExeC

A Burp Suite extension for cross-identity / cross-tenant access-control testing — BAC, IDOR, BOLA, and privilege escalation.

Authz-ExeC replays every request you make as a privileged user using each identity you configure (a low-privilege user, a second tenant, unauthenticated), compares each response against the privileged one, and shows a live colour matrix of where access control held, broke, or needs review. Think Autorize / AuthMatrix — rebuilt on the modern Montoya API, hardened against false positives, with first-class multi-tenant and GraphQL support.

🎬 Demo

✨ Features

⚡ Core

• 🧮 Matrix view — rows are endpoints, columns are identities. Each cell is a colour-coded verdict (BYPASSED / ENFORCED / REVIEW / NO-AUTH / WAF).
• 📥 Two ways to feed it: one-click Import Proxy History (in scope), or arm LIVE and browse.
• 🎭 Identities — swap Cookie, Authorization (JWT), and arbitrary headers (X-Tenant-Id, X-Api-Key, …), strip all auth (unauthenticated), or apply regex ID-rewrite rules for BOLA.
• 🔎 Request/response viewer per identity, colour count chips that double as click-to-filter, a free-text/time filter, CSV export, and a JWT decoder (alg:none / strip-signature helpers).

🎯 Accuracy (low false-positive)

• 🧠 Three-state model (privileged A / identity B / unauthenticated C) — a real bypass needs B looks like A and C was refused. If C also succeeds the endpoint is simply public.
• 🧹 Body normalisation — strips timestamps, UUIDs, CSRF/nonce tokens, and trace-ids before diffing.
• 📊 JSON key-set similarity, weighted-token similarity, and length tolerance.
• 🐤 Canary markers — tag a string unique to each tenant; a foreign marker appearing in another identity's response is near-proof of a cross-tenant leak.
• 🛡️ Guards for WAF / rate-limit blocks, soft errors (200 + "access denied"), empty results (row-level filtering), and login redirects. Per-verdict confidence score.

🧩 Coverage

• 📡 GraphQL — auto-tests POST queries (even with POST off); mutations gated behind a write method.
• 🗂️ API mode — tests JSON, files/images (IDOR objects), XML, and empty/204/header-based responses; skips only rendered HTML pages.
• 🔁 Value-aware de-dup — same path