authz-differ: catch broken access control by diffing responses
Replay one HTTP request under multiple identities and diff the responses to catch IDOR, BOLA and missing authorization — credentials redacted, evidence block ready to paste.
Broken access control is the most common serious web vulnerability, and one of the most tedious to test by hand: take one request, replay it as user A, user B, an admin and an anonymous client, then compare what each one gets back.
authz-differ automates that. You give it a request and a set of identities; it replays and diffs the responses, surfacing the cases where a lower-privileged identity sees data or actions it should not.
What it does
- Replays a single request across multiple identities (roles, tokens, sessions).
- Diffs the responses so an unexpected 200 or a leaked field stands out immediately.
- Redacts credentials automatically, so the output is safe to attach.
- Produces an evidence block that is ready to paste into a report.
It turns the classic two-account IDOR test into a repeatable command, and the output is already clean enough to hand to a triager.