Auth Analyzer

Just navigate through the web application with a high privileged user and let the Auth Analyzer repeat your requests for any defined non-privileged user. With the possibility to define Parameters the Auth Analyzer is able to extract and replace parameter values automatically. With this for instance, CSRF tokens or even whole session characteristics can be auto extracted from responses and replaced in further requests. Each response will be analyzed and tagged on its bypass status.

There are other existing Burp Extensions doing basically similar stuff. However, the force of the parameter feature and automatic value extraction is the main reason for choosing Auth Analyzer. With this you don’t have to know the content of the data which must be exchanged. You can easily define your parameters and cookies and Auth Analyzer will catch on the fly the values needed. The Auth Analyzer does not perform any preflight requests. It does basically just the same thing as your web app. With your defined user roles / sessions.

Sample Usage:
- Auto extract session Cookie
- Session Header and CSRF Token Parameter
- Auto extract from JavaScript variable
- Auto extract and insert a Bearer Token
- Test several roles at a time
- Refresh Auto Exracted Parameter Value
- Test idempotent Operations
- Test anonymous sessions
- Test CORS configuration
- Test CSRF Check mechanism
- Verify the Bypass Status