AuthSentry: An Automated Authorization Testing Tool for API

Author

Aditya Babar, Yash Lohakare, Kshitija Rahangdale, Manish Waghmare,Sharayu Patil

Abstract

 Broken Object Level Authorization (BOLA) is ranked first in the OWASP API Security Top 10. It occurs when an API confirms that a user is logged in but never checks whether the requested object belongs to that user, so changing an identifier in a request can expose another person’s data. Because the missing check depends on each application’s own logic, signature-based scanners often miss it, manual penetration testing is slow and expensive, and many existing tools need security expertise or source code access. This paper presents AuthSentry, an automated black-box tool that tests a live REST API for BOLA from the outside. Given an API address, a list of endpoints and sample authenticated requests, the tool normalizes the input, identifies object identifiers, sends targeted probe requests that replay requests with another user’s token, analyzes the responses against a stored baseline using rule-based detection, and reports each verdict with a plain-language reason. The system uses a Python and Flask backend for probing and analysis, a React web interface and Firebase for data storage. The web interface and the core verdict logic have been implemented and demonstrated on local test servers; measured detection rate, false-positive rate and scan time on named vulnerable APIs are planned and are not claimed in this paper.

Keywords

Broken Object Level Authorization, API Security, Black-Box Testing, Authorization Testing, REST API, OWASP

Full Text:

Download Paper PDF

References

[1] OWASP Foundation, “OWASP API Security Top 10 – 2023.” [Online]. Available: https://owasp.org/API-Security/editions/2023/en/0x11-t10/

[2] OWASP Foundation, “Web Security Testing Guide (WSTG).” [Online]. Available: https://owasp.org/www-project-web-security-testing-guide/

[3] MITRE, “CWE-639: Authorization Bypass Through User-Controlled Key.” [Online]. Available: https://cwe.mitre.org/data/definitions/639.html

[4] V. J. M. Manès et al., “The Art, Science, and Engineering of Fuzzing: A Survey,” IEEE Trans. Softw. Eng., 2019. [Online]. Available: https://arxiv.org/abs/1812.00140

[5] V. Atlidakis, P. Godefroid and M. Polishchuk, “RESTler: Stateful REST API Fuzzing,” in Proc. 41st Int. Conf. Software Engineering (ICSE), 2019.

[6] R. Fielding and J. Reschke (Eds.), “RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content,” IETF, 2014.

[7] M. Jones and D. Hardt, “RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage,” IETF, 2012.

[8] D. Hardt (Ed.), “RFC 6749: The OAuth 2.0 Authorization Framework,” IETF, 2012.

[9] FIRST, “Common Vulnerability Scoring System v3.1: Specification Document,” Forum of Incident Response and Security Teams.

Share your valuable work from Social Media Buttons