What If Burp Suite Could Teach Itself Who Owns an API Object?

How do you automatically tell when one user can access another user's data?

The Problem

Imagine Alice is allowed to access her order:

GET /api/orders/101
Authorization: Bearer ALICE_TOKEN

GET /api/orders/101
Authorization: Bearer ALICE_TOKEN

Now change the ID:

GET /api/orders/102
Authorization: Bearer ALICE_TOKEN

GET /api/orders/102
Authorization: Bearer ALICE_TOKEN

If order 102 belongs to Bob and Alice still gets the data, that could be a BOLA/IDOR vulnerability.

Doing this manually across hundreds of requests gets slow very quickly.

So I built AuthForge.

How AuthForge Works

AuthForge takes traffic captured from Burp Suite and tries to understand:

• Who the users are
• What objects they accessed
• Which objects belong to which users

Then it automatically generates authorization tests.

Burp Traffic
     ↓
Find Users
     ↓
Find Objects
     ↓
Build Relationships
     ↓
Generate Tests
     ↓
Verify Access
     ↓
Report Findings

Burp Traffic
     ↓
Find Users
     ↓
Find Objects
     ↓
Build Relationships
     ↓
Generate Tests
     ↓
Verify Access
     ↓
Report Findings

For example:

Alice → Order 101 → Allowed
Bob   → Order 202 → Allowed
Bob   → Order 101 → Should be denied

Alice → Order 101 → Allowed
Bob   → Order 202 → Allowed
Bob   → Order 101 → Should be denied

AuthForge can test that last case automatically.

Avoiding False Positives

A 200 OK doesn't always mean there's a vulnerability.

Some APIs may return the same response for different IDs, so a simple status code check can produce false positives.

AuthForge uses a control object, another object that the target user is known to own, to help verify whether the authorization boundary was actually bypassed.

The goal is simple:

Don't just find suspicious behavior. Try to prove it.

Safe by Default

AuthForge starts in dry run mode.

It doesn't send live requests unless execution is explicitly enabled. Mutating requests require an additional flag.

The tool is intended for systems you own or are explicitly authorized to test.

Try It

go build -o authforge
./authforge -config examples/init.yaml

go build -o authforge
./authforge -config examples/init.yaml

What It Produces

AuthForge can generate:

• Security findings
• HTML and JSON reports
• Authorization graphs
• Attack paths
• Regression baselines

Where This Is Going

The idea behind AuthForge is simple:

Turn Burp traffic into repeatable authorization tests.

I'm still improving the project and exploring better ways to discover authorization relationships, reduce false positives, and make testing easier.

GitHub: https://github.com/deep-sengupta/AuthForge