AuthMatrix: Simplified Authorization Testing for Web Applications
summary
Introduces AuthMatrix, a Burp Suite extension that automates authorization testing by mapping roles, recording session tokens, generating every role×action request, checking success via regex, and highlighting unauthorized successes; claims it covers about 90% of targets, supports static CSRF tokens and single session cookies, saves and reloads test configs, and finds multiple real bypasses in the live demo. Open source and in the Burp App Store; limitations include no dynamic CSRF handling and no multi‑token support.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:10Getting Easier to Do Right
- 3:35The Problem
- 6:22OWASP Top 10 - Specialized
- 7:03Authorization Examples
- 8:36Authorization Challenges
- 9:47Authorization Testing
- 11:34Threat Modeling
- 13:28AuthMatrix - Design Goals
- 33:29Revised Methodology
- 34:18Usage Tips/Tricks
- 40:12Current Limitations
- 42:06Whats Next?
related talks
38mHarder better faster stronger auth with OpenID Connect
47mHow to Test Authentication and Authorization for Security
54mATOR (Authentication Token Obtain and Replace) Burp Plugin
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
27mCommon Application Security Mistakes that Enable Automated Attacks
55mAPI Security Assurance via E2E Testing
39mAuthentication & Authorization Architecture in the MEAN Stack
01h 46mAuthentication & Authorization