authorization-testing

API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates

Burp Suite extension for authorization testing in Java serialized communication: decode, inspect, and edit serialized objects live

Authorization testing for MCP servers.

自建授权攻防靶场体系 · Authorized adversarial testing lab — curated variant ammo, WAF/CRS rule reverse-engineering, multi-agent AI red-team hunting

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

ReqEye is a CLI assistant for HTTP request analysis, designed to help security researchers, bug bounty hunters, and pentesters identify high‑value entry points worth manual testing. It does not scan targets, send traffic, or claim vulnerabilities. ReqEye focuses on where to look, not on making assumptions.

A tool that detects unauthorized access vulnerabilities through passive proxies, leveraging mainstream AI systems such as Kimi, DeepSeek, GPT, and others,vulnerabilities, privilege-escalation, authorization-bypass, detects-access

UGPwn (echoheistv2): authorized research tooling for the Ultimate Guitar Guitar Pro download authorization flow — Go/Bubble Tea TUI, Preact dashboard, Puppeteer worker

Diff HAR captures from two privilege levels into an authorisation (IDOR/BOLA) test plan. Redacts credentials by default.

CI-native differential authorization regression testing for Python—replay exact permission cases, enforce invariants, and catch DENY→ALLOW changes.

3-stage authorized security pipeline: CDP mapper, multi-actor permission matrix, and automated PoC generation

A tool that detects unauthorized access vulnerabilities through passive proxies, leveraging mainstream AI systems such as Kimi, DeepSeek, GPT, and others,vulnerabilities, privilege-escalation, authorization-bypass, detects-access

Continuous cross-tenant authorization testing (IDOR/BOLA) from any OpenAPI/Swagger spec. Built from real bug-bounty fieldwork.

State-aware Burp Suite extension for mutating multi-step workflows and detecting business-logic flaws with probes, invariants, isolated actors, and cleanup.

Scope-gated bug-bounty pipeline for HackerOne: passive recon, two-role authz/IDOR checks, redacted evidence, H1-ready reports, human approval queue. Local Ollama + cbh + ARTEX wiring; nothing auto-submits.