wuntee/burpauthzplugin

Burp plugin to test for authorization flaws

Usage:

1. Right click action to "Send request(s) to Authz"
2. Create a modified cookie - presumably for a different user
3. Click 'Run'
4. Notice differences in responses

burpauthzplugin's Issues

lose BurpExtender

lose BurpExtender ,need to decompile ->get BurpExtender.java

Problem with anti-CSRF tokens

I am afraid there is a significant issue with using this plugin while testing applications with anti-CSRF tokens in URL-s. Requests recorded from one user won't work with other one's cookie due CSRF tokens in place. Of course this side effect can be actually used to test if those tokens are being verified, nonetheless when they are there is no way to test for authorization bypass. I did not find a way to manipulate the requests before sending them to AuthZ and persisting their responses at the same time - it would be great if you added an option for modification of request parameters other than cookie. In this particular case I would replace the original user token.
Keep up the good work!

[enhancement request] Large cookie value - word wrap feature

Hi,

It would be nice if for a very large cookie value be able to word-wrap it somehow:

Thanks!