为什么值得关注

采用三状态比较模型，结合响应体归一化、Canary 标记、WAF/限流防护机制，有效降低误报；原生支持 GraphQL 和多租户场景。

适合谁使用

渗透测试人员
安全研究员
漏洞赏金猎人
Web 应用开发者

典型使用场景

通过以低权限用户身份重放已认证请求来测试特权提升
利用 Canary 标记和身份切换检测跨租户数据泄露
使用 ID 重写规则和值感知去重自动化 IDOR 和 BOLA 测试
验证 GraphQL 查询和变更的授权有效性

项目优势

三状态模型与响应体归一化实现低误报检测
支持 Cookie、JWT、自定义头等多种身份类型及 ID 重写（BOLA）
内置 GraphQL 支持，自动区分查询/变更并去重
可配置速率限制、范围限定和试运行模式，保障安全测试

使用前须知

需要 Burp Suite（专业版或社区版）及 Java 17+ 才能从源码构建
仅测试在范围内的请求，可能不覆盖所有认证方案（如未明确提及 OAuth 令牌）
默认会测试 PUT/PATCH/DELETE 等破坏性方法，只读测试需手动关闭

README 快速开始

🔐 Authz-ExeC

A Burp Suite extension for cross-identity / cross-tenant access-control testing — BAC, IDOR, BOLA, and privilege escalation.

Authz-ExeC replays every request you make as a privileged user using each identity you configure (a low-privilege user, a second tenant, unauthenticated), compares each response against the privileged one, and shows a live colour matrix of where access control held, broke, or needs review. Think Autorize / AuthMatrix — rebuilt on the modern Montoya API, hardened against false positives, with first-class multi-tenant and GraphQL support.

🎬 Demo

✨ Features

⚡ Core

🧮 Matrix view — rows are endpoints, columns are identities. Each cell is a colour-coded verdict (BYPASSED / ENFORCED / REVIEW / NO-AUTH / WAF).
📥 Two ways to feed it: one-click Import Proxy History (in scope), or arm LIVE and browse.
🎭 Identities — swap Cookie, Authorization (JWT), and arbitrary headers (X-Tenant-Id, X-Api-Key, …), strip all auth (unauthenticated), or apply regex ID-rewrite rules for BOLA.
🔎 Request/response viewer per identity, colour count chips that double as click-to-filter, a free-text/time filter, CSV export, and a JWT decoder (alg:none / strip-signature helpers).

🎯 Accuracy (low false-positive)

🧠 Three-state model (privileged A / identity B / unauthenticated C) — a real bypass needs B looks like A and C was refused. If C also succeeds the endpoint is simply public.
🧹 Body normalisation — strips timestamps, UUIDs, CSRF/nonce tokens, and trace-ids before diffing.
📊 JSON key-set similarity, weighted-token similarity, and length tolerance.
🐤 Canary markers — tag a string unique to each tenant; a foreign marker appearing in another identity's response is near-proof of a cross-tenant leak.
🛡️ Guards for WAF / rate-limit blocks, soft errors (200 + "access denied"), empty results (row-level filtering), and login redirects. Per-verdict confidence score.

🧩 Coverage

📡 GraphQL — auto-tests POST queries (even with POST off); mutations gated behind a write method.
🗂️ API mode — tests JSON, files/images (IDOR objects), XML, and empty/204/header-based responses; skips only rendered HTML pages.
🔁 Value-aware de-dup — same path

项目描述

Burp Suite extension for cross-identity & cross-tenant access-control testing — BAC, IDOR, BOLA, and privilege escalation.

Authz-ExeC