Skip to content

Latest commit

 

History

History
34 lines (28 loc) · 1.44 KB

File metadata and controls

34 lines (28 loc) · 1.44 KB

00 — Overview

AuthProbe answers one question that automated tooling usually can't: can one authenticated user read another user's objects?

That is Broken Object Level Authorization (OWASP API1:2023) — the #1 API risk since 2019 and the root of large recruitment-data exposures. It is invisible to WAFs and single-identity DAST because the malicious request is syntactically valid; only multi-identity, object-level testing reveals it.

Pipeline

OpenAPI spec ──▶ detect (list, fetch) resources
                     │
  identities  ──▶ discover which objects each identity owns (via list endpoint)
                     │
                     ▼
   probes:  bola · idor/enumeration · missing_auth · existence_oracle
                     │
                     ▼
   findings ──▶ console / JSON / Markdown / JUnit  +  non-zero exit for CI

See docs/diagrams/pipeline.mmd for the rendered diagram.

Design principles

  • Spec-driven. Resources are detected from the target's OpenAPI document, so the same config works across releases and across APIs.
  • Evidence-based. A finding requires proof that the attacker identity actually received the victim's object (response diffing against a ground-truth fetch).
  • CI-native. JUnit output and a severity-thresholded exit code make it a build gate, not a one-off manual test.
  • Responsible. Non-local scans require an explicit authorization acknowledgment.