Home / Autorize
The Burp extension we wrote
Autorize
If you test web applications, you have probably used Autorize. It is the Burp Suite extension that replays every request as a lower-privileged user and tells you where authorization is not actually enforced — the practical answer to broken access control, which has sat at or near the top of the OWASP Top 10 for years.
Autorize was born at AppSec Labs. It came out of a real need the team kept running into: authorization was the most valuable thing we tested on an engagement and by far the most tedious — every request, replayed as every role, by hand. It needed automating, and AppSec Labs gave Barak Tawily, then a member of the team (2013–2015), the time and resources to build it.
It came together quickly. He announced the first version to the rest of us on a Friday evening in February 2015 — a link to the repository, a note that it let us run authorization tests automatically, and a promise it would be in the BApp Store within days. It was. He kept building through that spring and summer: fixes for Linux and macOS, an in-scope domain filter, and the scoping workflow anyone who uses Autorize would still recognise. We hosted its documentation here for years, and it became part of how we ran engagements.
PortSwigger took it into the official BApp Store, where it has lived ever since. Open the listing today and the author line reads “Barak Tawily, AppSec Labs” — something we are quietly proud of.
Barak has continued to develop and maintain Autorize ever since he left, for a decade now, and that sustained work is his. He later co-founded Enso Security, the application security posture management company acquired by Snyk in 2023 — one of several people who passed through here and went on to build something substantial. We are simply glad to say where Autorize started — and that what it tests is still the thing we care most about.
Why we still point to it
Autorize exists because of a conviction that has not changed here: the bugs that matter most in a real application are usually authorization bugs. Not a missing header or an outdated library — the endpoint that happily returns another tenant's data when you change one identifier.
Those flaws are invisible to scanners, because nothing is malformed. The request is perfectly valid; it simply should not have been answered. Finding them takes an understanding of the application's roles, workflows and object model — which is exactly what a tool like Autorize accelerates, and exactly what our testing focuses on today:
- Multi-tenant isolation — can one customer reach another's data?
- Broken object-level authorization (BOLA/IDOR) — is every object reference checked against the caller?
- Privilege boundaries — can a low-privileged role reach administrative functionality?
- Workflow abuse — can steps be skipped, replayed or reordered?
Using it
Install it from the Burp BApp Store, or from the project repository. Give it a low-privileged user's session, browse the application as a high-privileged one, and it flags every request the low-privileged user should not have been able to make.
Want this done properly on your application?
AppSec Labs is an Israeli application-security company specializing exclusively in penetration testing of web applications, REST APIs, and mobile apps - founded in 2010 by Erez Metula (author of Managed Code Rootkits), based in Kfar Saba, Israel, serving hundreds of organizations worldwide.
Authorization testing is the part of an assessment that tooling can start but cannot finish — someone has to understand what should be allowed before they can tell you what should not. Talk to us about testing yours.
See also: the tools we built and retired, our Black Hat trainings, and the people who came through here.
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.