Burp Autorize Extension: Automate IDOR Testing Without Missing Hits

Burp Autorize Extension: Automate IDOR Testing Without Missing Hits

You already swap cookies by hand. Autorize does that swap on every in-scope request and tells you when a low-privilege session still gets a 200 with real data. That is the whole pitch. The skill is configuring it so the noise does not bury the bugs.

Setup that actually works

Install Autorize from the BApp Store. Create Account A (victim) and Account B (attacker / low priv). Log in as B in Burp’s browser. Copy B’s full Cookie header — or Authorization bearer — into Autorize’s “Replacement headers / cookies” field. Browse as A while Autorize reissues each request as B.

I pin Authorization and Cookie together when the app uses both. Leaving one stale creates fake “denials” that look like solid authZ.

What green and red mean (and when they lie)

Autorize colors responses by status and length heuristics. A green “enforced” result can still be wrong if both accounts get identical empty JSON. A red “bypassed” hit can be a shared public asset. Always open the original vs unauthorized tabs and diff bodies.

Filter out:

• Static JS/CSS and font paths
• Health checks and feature-flag endpoints that return the same blob for everyone
• Logout and CSRF-token endpoints that intentionally succeed for any session

Keep API routes that carry object IDs, export jobs, inbox threads, and admin-looking verbs.

Hunting rhythm for a new target

Map the app once with A. Turn interception off; let Autorize watch. Click every object type you care about: invoices, messages, attachments, team members. Then force-browse a few IDs you saw in A’s traffic while Autorize still substitutes B.

When a candidate appears, reproduce outside the extension: Repeater, two sessions, change only the auth material. Screenshot both responses. That is your proof. Autorize is triage, not evidence.

Headers people forget

Some stacks check a custom X-User-Id or X-Org-Id beside the session. Put those in the replacement set if the client sends them. If the server ignores the session and trusts the header, Autorize will light up immediately — and you just found a classic broken access control issue mapped under CWE-639.

SPA apps that stash JWTs in localStorage need the bearer in Autorize, not only cookies. Mixed session modes are where I have seen hunters “prove” nothing because the wrong credential rode along.

Report shape triagers like

Title the object and the action (“Low-priv user can GET /api/invoices/{id} of another org”). Attach original request, unauthorized replay, and a one-line diff of PII. Mention you found the candidate with Autorize but verified manually. Link methodology to PortSwigger’s IDOR material so severity talk stays grounded.

Autorize will not invent authZ bugs for you. It removes the boredom so you can spend attention on the responses that disagree.