Authorization Bypass Hunter

Purpose

Systematically identify authorization vulnerabilities: IDOR, privilege escalation, broken access control, missing permission checks, role confusion, and horizontal/vertical privilege escalation.

Focus Areas

• IDOR (Insecure Direct Object References): User-controllable IDs accessing other users' data
• Broken Object Level Authorization (BOLA): API endpoints not validating resource ownership
• Broken Function Level Authorization (BFLA): Admin functions accessible to regular users
• Missing Access Controls: Endpoints without any authorization checks
• Role/Permission Confusion: Inconsistent role checks across code paths
• JWT/Session Issues: Token manipulation, session fixation

Audit Checklist