X-AUT
Autorize
Free Burp extension that automates authorization testing by replaying every request with a lower-privileged session.
OVERVIEW
Autorize, originally developed by Barak Tawily (github.com/Quitten/Autorize, also mirrored to the BApp Store as an official listing), solves a testing problem that's easy to describe and tedious to do by hand: for every single request the higher-privileged tester sends while browsing normally, it automatically replays it using a second, lower-privileged session's cookies/headers, then compares the two responses and flags any pair that look the same — meaning the low-privilege user got access it shouldn't have had.
It runs passively in the background of a normal testing session rather than as a one-off scan, so it builds up authorization findings across an entire engagement's worth of browsing instead of just the handful of endpoints a tester remembers to check manually. It plugs into the same Burp Suite proxy session as the base entry on this site.
USE CASES
Practical use cases
- 01
Passively surfacing IDOR and broken object-level authorization across every endpoint browsed during a normal manual test.
- 02
Confirming that a role-based access control matrix (admin vs. regular user, tenant A vs. tenant B) is actually enforced server-side.
- 03
Catching authorization regressions across a full re-test by re-running the same browsing session against a fixed build.
- 04
Distinguishing unauthenticated bypass from horizontal-privilege bypass by configuring a third, unauthenticated comparison session.
QUICK START
Once two accounts of different privilege levels exist, to automatically flag every request the low-privilege session shouldn't have been able to repeat.
- Get two (or three) test accounts at different privilege levels explicitly provisioned for this purpose by the client.
- Install Autorize from the BApp Store.
- Configure the extension with the lower-privileged session's cookie/header and any authentication headers to exclude from comparison.
- Browse the application normally as the higher-privileged user with the proxy running.
- Review Autorize's results table, focusing first on entries flagged as bypassed rather than the enforced/redirected ones.
BEFORE YOU RUN IT
What to check before running it
The repository ships with no LICENSE file, so treat it as source-available rather than a formally open-source-licensed project when deciding how to redistribute or fork it.
Comparison is response-based (status code, length, content) and needs tuning per app — dynamic content (timestamps, CSRF tokens, nonces) causes false positives unless excluded first.
Only test with accounts explicitly provisioned for this purpose; replaying arbitrary users' real sessions crosses into unauthorized access even during an authorized engagement.