DOCSEARCHbyAlgolia
Submit Docs

AutorizePro

repository·master·Indexed 20 days ago

https://github.com/wuliruler/autorizepro

A Burp Suite plugin for automated authorization and broken access control detection. It allows users to test for IDOR and authorization bypasses by injecting authentication headers and comparing responses. The plugin includes an optional AI analysis module compatible with OpenAI-format APIs (including local models like Ollama) to reduce false positives in complex interface responses.

Tokens
1.9K
Snippets
3
Records
9
Agent score
20%

What's inside AutorizePro

  1. Understand AutorizePro detection statuses

    master

    The plugin categorizes authorization test results into three main states:

    • Bypassed! (Red): The plugin determined an authorization bypass occurred (Vulnerability detected).
    • Enforced! (Green): The plugin determined no authorization bypass occurred (Access is correctly enforced).
    • Is enforced??? (Gray/Unknown): The plugin could not determine the status. You can improve accuracy by configuring specific authorization patterns in the enforcement detector / 已鉴权规则 settings.

  2. Filter Intercepted Requests

    master

    To prevent unnecessary analysis and reduce costs (especially when using AI), you should configure interception rules using Burp Suite's Interception Filters.

    • Scope: Use blacklists, whitelists, or regular expressions to define which domains/requests the plugin should monitor.
    • Static Resources: By default, the plugin excludes scripts, images, and HTML pages. You can add more static resource types to the ignore list to further refine detection.

  3. Configure Interception Filters for AutorizePro

    master

    To avoid unnecessary analysis and prevent security risks (like cookie leakage), use Burp Suite's Interception Filters to define the scope of AutorizePro.

    • Scope Control: Configure filters to only intercept specific domains or requests matching certain patterns.
    • Filter Types: Supports Blacklists, Whitelists, Regular Expressions, or Burp's existing Scope.
    • AI Cost Management: If using paid AI services, strictly define your target scope in Interception Filters to avoid sending non-target traffic to the AI API.

    Note: The tool automatically ignores static resources, HTML pages, and error status codes by default.

  4. Configure AutorizePro for Authorization Testing

    master

    Once installed, follow these steps to begin testing for authorization bypasses:

    1. Open Configuration: Click AutorizePro -> Configuration.
    2. Set Injected Header: Paste the second account's authorization header into the Insert injected header here textbox. This header will replace existing ones or be added as a new one.
    3. Unauthenticated Testing: If you want to test requests without any cookies, ensure Check unauthenticated is checked (it is enabled by default).
    4. Enable Plugin: Click the AutorizePro is off button to toggle the plugin to an active state.
    5. Review Results: Use the left-side results view to see request URLs and access control statuses. Click a URL to view the Original, Modified (Auth), and Unauthenticated request/response details in the right-side viewer.

  5. Install AutorizePro in Burp Suite

    master

    To install AutorizePro, you must first set up a Python environment in Burp Suite using Jython, then add the plugin extension.

    1. Prepare Requirements

    2. Configure Python Environment in Burp

    1. Open Burp Suite.
    2. Navigate to Extender -> Options.
    3. In the Python Environment section, click Select File.
    4. Select the downloaded Jython standalone JAR file.

    3. Install the Plugin

    1. Download and unzip the latest release ZIP of AutorizePro.
    2. In Burp Suite, navigate to Extender -> Extensions -> Add.
    3. Set Extension Type to python.
    4. In Extension file, select the AutorizePro.py file.

    Note: Ensure the file path does not contain Chinese characters, otherwise installation will fail.

    # No specific command, follow the manual steps above.

  6. Configure and use AutorizePro for authorization testing

    master

    Follow these steps to start detecting authorization vulnerabilities (IDOR/Broken Access Control):

    1. Open Configuration: Click AutorizePro -> Configuration.
    2. Set Authentication Header: Copy the second account's authentication header into the Insert injected header here text box. The plugin will replace existing headers with this one or add it if missing.
    3. Unauthenticated Testing: Uncheck Check unauthenticated if you do not want to test requests without any cookies (enabled by default).
    4. Enable Plugin: Click the AutorizePro is off button to toggle it to on.
    5. Review Results:
      • View URLs and permission status in the left results pane.
      • Select a URL and use the Request/Resppnse Viewers Tab on the right to compare the Original, Unauthorized, and Bypassed (Authorization bypass) requests/responses.

    Security Tip: Use Interception Filters to restrict testing to specific domains to prevent cookie leakage to unintended sites.

  7. Configure AI Analysis for Authorization Detection

    master

    AI analysis helps reduce false positives (from ~95% down to ~5%) by analyzing API responses. It is optional and can be configured in two ways:

    Using Default API

    • Select a model.
    • Enter the corresponding API Key.
    • Check the Enable AI checkbox.

    Using Custom (OpenAI-compatible) API

    • URL: Enter your custom endpoint (e.g., http://localhost:11434/v1/chat/completions for Ollama).
    • KEY: Enter your API Key (leave empty for local models like Ollama).
    • Model: Enter the model name.
    • Enable AI: Check the Enable AI checkbox.

    Note on Cost Optimization: To save costs, AI analysis is only triggered for packets that meet these criteria:

    • Equal status codes.
    • JSON format responses.
    • Response length under 3000 characters.

  8. Configure Custom AI Analysis (OpenAI Compatible)

    master

    AutorizePro features an optional AI module to reduce false positives (from ~95% down to ~5%). It supports any OpenAI-compatible API endpoint, including local models like Ollama or enterprise private models.

    Configuration Steps

    1. URL: Enter your API endpoint (e.g., http://localhost:11434/v1/chat/completions for Ollama).
    2. KEY: Enter your API Key. Leave blank for local models like Ollama.
    3. Model: Enter the model name (e.g., llama3).
    4. Enable: Check the 启用 AI (Enable AI) checkbox.

    API Requirements

    Your custom API must follow the OpenAI /v1/chat/completions format.

    Request Format:

    {
    "model": "your-model-name",
    "messages": [
        {"role": "system", "content": "..."},
        {"role": "user", "content": "..."}
    ]
}

    Response Format:

    {
    "choices": [{
        "message": {
            "content": "{\"res\":\"true\",\"reason\":\"...\"}"
        }
    }]
}
    Example Ollama Config:
URL: http://localhost:11434/v1/chat/completions
KEY: (empty)
Model: llama3

  9. Configure Custom AI API Endpoints

    master

    AutorizePro supports any OpenAI-compatible /v1/chat/completions endpoint. This allows for local LLMs (Ollama, LocalAI), enterprise private models, or other cloud providers.

    API Requirements

    Your custom endpoint must follow these JSON formats:

    Request Format:

    {
    "model": "your-model-name",
    "messages": [
        {"role": "system", "content": "..."},
        {"role": "user", "content": "..."}
    ]
}

    Response Format:

    {
    "choices": [{
        "message": {
            "content": "{\"res\":\"true\",\"reason\":\"...\"}"
        }
    }]
}

    Configuration Examples

    Use CaseURLKeyModel
    Ollama (Local)http://localhost:11434/v1/chat/completions(empty)llama3
    Enterprisehttps://api.company.com/v1/chat/completionssk-xxxcompany-model-v2
    Cloud Providerhttps://api.provider.com/v1/chat/completionsyour-api-keyprovider-model-name
    {
    "model": "your-model-name",
    "messages": [
        {"role": "system", "content": "..."},
        {"role": "user", "content": "..."}
    ]
}