Find who can access what in your web app.
What it does
Produces an assessment of authorization weaknesses in web applications and APIs, including cross-user and cross-tenant access.
When to use it
Use during authorized penetration tests or audits of role-based access, API authorization, and multi-tenant isolation.
How to use it
Give it an authorized target application and documentation of expected role permissions; it returns an access-control assessment report.
What you provide
- the target application URL
- Your files
Good to know
- cannot be undone: target.example.com
- sends a credential to a server: USER_TOKEN; USER_A_TOKEN; TENANT_A_TOKEN
What you need · 9
Requires Burp Suite Professional for request interception and role-based access-control testing.
Requires the Authorize extension for automated testing across authentication contexts; the workflow includes installing it.
Access · 2
This skill
target.example.com
Modifies and deletes target application data (irreversible)
Authorize
Installs the Authorize extension