Auth Analyzer
Summary: PortSwigger's BApp Store lists Auth Analyzer, a Burp extension by Simon Reinhart at version 1.1.14, last updated 08 May 2024, that finds authorization bugs by replaying a high-privileged user's requests as a defined non-privileged user. It can extract and replace parameter values such as CSRF tokens or whole session characteristics from responses, tags each response by bypass status, and repeats selected sitemap resources through the context menu to run semi-automated authorization tests.
Why it matters: The tool exists because authorization bugs surface when the same request succeeds for a lower-privileged user, and it can replay a complex site's requests in seconds - so the access-control gaps it looks for are ones a determined tester can find quickly against your application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026