AuthProbe

An OpenAPI-driven, multi-identity BOLA/IDOR scanner for recruitment (and other) APIs. AuthProbe logs in as two or more identities you control, walks and enumerates object IDs, and diffs the responses to detect when one identity can read another's records — the Broken Object Level Authorization (BOLA/IDOR) flaw class behind incidents like McHire. It's driven by the target's OpenAPI spec and returns a non-zero exit code so it can gate your CI build.

⚠️ Authorized use only. Run AuthProbe against APIs you own or are explicitly permitted to test. It refuses non-local targets unless you pass --i-have-authorization. See SECURITY.md.

---

Why this exists

Broken Object Level Authorization has been the #1 OWASP API risk since 2019, and it is precisely the class of flaw that WAFs and single-identity scanners cannot catch — a BOLA request is a syntactically valid request. Finding it requires contextual, multi-identity, object-level testing: log in as A, try to read B's object, and see if it leaks. AuthProbe automates exactly that, from an OpenAPI spec, in CI.

Quickstart (30 seconds, no external target)

git clone https://github.com/jbarach2012/AuthProbe
cd AuthProbe
pip install -e ".[test]"

python -m authprobe.demo     # spins up a vulnerable + a secure demo ATS and scans both
pytest -q                    # 11 tests

Demo output:

=== Scanning VULNERABLE target ===
  [HIGH] Broken Object Level Authorization (BOLA)   alice retrieved object '2' owned by 'bob'
  [HIGH] Broken Object Level Authorization (BOLA)   bob retrieved object '1' owned by 'alice'
  [HIGH] IDOR via sequential-ID enumeration         alice reached non-owned objects [2] ...
  [MED ] Enumerable (sequential/numeric) identifiers
  summary: 4 finding(s) [high=3, medium=1]

=== Scanning SECURE target ===
  AuthProbe: no authorization findings.

Scan a real target

# 1. write a config (see examples/config.example.yaml)
# 2. run:
authprobe scan --config myconfig.yaml --format console json junit --out out/
echo "exit code: $?"   # non-zero if findings at/above fail_on

Minimal config:

target:
  base_url: "http://127.0.0.1:8000"
  spec: "auto"                       # fetch {base_url}/openapi.json
identities:
  - name: alice
    headers: { Authorization: "Bearer alice-token" }
  - name: bob