[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93401":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":12,"openIssues":13,"contributorsCount":13,"subscribersCount":13,"size":13,"stars1d":13,"stars7d":13,"stars30d":13,"stars90d":13,"forks30d":13,"starsTrendScore":13,"compositeScore":14,"rankGlobal":8,"rankLanguage":8,"license":15,"archived":16,"fork":16,"defaultBranch":17,"hasWiki":18,"hasPages":16,"topics":19,"createdAt":8,"pushedAt":8,"updatedAt":20,"readmeContent":21,"aiSummary":22,"trendingCount":13,"starSnapshotCount":13,"syncStatus":23,"lastSyncTime":24,"discoverSource":25},93401,"AuthProbe","jbarach2012\u002FAuthProbe","jbarach2012",null,"Python",102,82,1,0,42.76,"Apache License 2.0",false,"main",true,[],"2026-07-22 04:02:09","# AuthProbe\n\n**An OpenAPI-driven, multi-identity BOLA\u002FIDOR scanner for recruitment (and other) APIs.**\nAuthProbe logs in as two or more identities you control, walks and enumerates\nobject IDs, and diffs the responses to detect when one identity can read\nanother's records — the Broken Object Level Authorization (BOLA\u002FIDOR) flaw class\nbehind incidents like McHire. It's driven by the target's OpenAPI spec and returns\na non-zero exit code so it can gate your CI build.\n\n\u003C!-- After you create the repo -->\n![ci](https:\u002F\u002Fgithub.com\u002Fjbarach2012\u002FAuthProbe\u002Factions\u002Fworkflows\u002Fci.yml\u002Fbadge.svg)\n[![License: Apache 2.0](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-Apache_2.0-blue.svg)](LICENSE)\n\n> ⚠️ **Authorized use only.** Run AuthProbe against APIs you own or are explicitly\n> permitted to test. It refuses non-local targets unless you pass\n> `--i-have-authorization`. See [`SECURITY.md`](SECURITY.md).\n\n---\n\n## Why this exists\n\nBroken Object Level Authorization has been the #1 OWASP API risk since 2019, and\nit is precisely the class of flaw that **WAFs and single-identity scanners cannot\ncatch** — a BOLA request is a syntactically valid request. Finding it requires\n*contextual, multi-identity, object-level* testing: log in as A, try to read B's\nobject, and see if it leaks. AuthProbe automates exactly that, from an OpenAPI\nspec, in CI.\n\n## Quickstart (30 seconds, no external target)\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002Fjbarach2012\u002FAuthProbe\ncd AuthProbe\npip install -e \".[test]\"\n\npython -m authprobe.demo     # spins up a vulnerable + a secure demo ATS and scans both\npytest -q                    # 11 tests\n```\n\nDemo output:\n\n```\n=== Scanning VULNERABLE target ===\n  [HIGH] Broken Object Level Authorization (BOLA)   alice retrieved object '2' owned by 'bob'\n  [HIGH] Broken Object Level Authorization (BOLA)   bob retrieved object '1' owned by 'alice'\n  [HIGH] IDOR via sequential-ID enumeration         alice reached non-owned objects [2] ...\n  [MED ] Enumerable (sequential\u002Fnumeric) identifiers\n  summary: 4 finding(s) [high=3, medium=1]\n\n=== Scanning SECURE target ===\n  AuthProbe: no authorization findings.\n```\n\n## Scan a real target\n\n```bash\n# 1. write a config (see examples\u002Fconfig.example.yaml)\n# 2. run:\nauthprobe scan --config myconfig.yaml --format console json junit --out out\u002F\necho \"exit code: $?\"   # non-zero if findings at\u002Fabove fail_on\n```\n\nMinimal config:\n\n```yaml\ntarget:\n  base_url: \"http:\u002F\u002F127.0.0.1:8000\"\n  spec: \"auto\"                       # fetch {base_url}\u002Fopenapi.json\nidentities:\n  - name: alice\n    headers: { Authorization: \"Bearer alice-token\" }\n  - name: bob\n    headers: { Authorization: \"Bearer bob-token\" }\nsettings:\n  fail_on: high\n```\n\nProvide **two identities you control**. AuthProbe auto-detects\n`(GET \u002Fcollection, GET \u002Fcollection\u002F{id})` resource pairs from the spec (you can\nalso declare them explicitly), discovers which objects each identity owns via the\nlist endpoint, then runs its probes.\n\n## What it checks\n\n| Probe | OWASP | Severity | Detects |\n|-------|-------|----------|---------|\n| `bola` | API1:2023 | high | identity A can read identity B's object |\n| `idor` | API1:2023 | high | walking sequential IDs reaches non-owned objects |\n| `enumerable_id` | API1:2023 | medium | numeric\u002Fsequential identifiers (defense-in-depth) |\n| `missing_auth` | API2:2023 | critical | data returned with no credentials |\n| `existence_oracle` | API1:2023 | low | 403-vs-404 lets an attacker confirm real IDs |\n\nHow it decides a leak happened: it fetches each object as its owner to capture a\nground-truth view, then, as a different identity, refetches and confirms the\nresponse really returns that object (matching `id_field`). This response-diffing\nis what separates a true BOLA from a normal 404.\n\n## CI integration\n\nAuthProbe emits JUnit XML and exits non-zero when findings reach `fail_on`:\n\n```yaml\n- run: authprobe scan --config authprobe.yaml --format junit --out out\u002F --fail-on high\n```\n\nA regression that reintroduces an IDOR fails the build — the McHire class of bug,\ncaught before production.\n\n## How this helps\n\n- **HR-tech \u002F API teams** get the one test that catches their most likely and most\n  damaging flaw, spec-driven and CI-gated.\n- **Security reviewers** get repeatable, evidence-producing authorization tests\n  instead of manual Burp sessions.\n- **The community** gets an open, Apache-2.0 BOLA\u002FIDOR scanner purpose-built for\n  the multi-tenant, high-PII reality of recruitment APIs. It is the offensive\n  counterpart to a secure-by-design candidate-data layer: one shows how to build\n  it safely, this proves whether you did.\n\n## Docs\n\n[Overview](docs\u002F00-overview.md) · [How it works](docs\u002F01-how-it-works.md) ·\n[CI integration](docs\u002F02-ci-integration.md) · [Security policy](SECURITY.md) ·\n[Roadmap](ROADMAP.md)\n\n## License\n\n[Apache 2.0](LICENSE). AuthProbe is a defensive testing tool; use it responsibly\nand only where authorized.\n","AuthProbe 是一款基于 OpenAPI 规范的多身份授权漏洞扫描工具，用于自动化检测 Broken Object Level Authorization（BOLA）和 IDOR 类安全缺陷。它通过模拟两个或多个受控身份登录，自动枚举资源对象 ID 并比对响应差异，识别越权访问行为；支持 OpenAPI 自动解析、CI 集成（非零退出码）、本地\u002F远程目标扫描（需显式授权）。适用于 API 安全测试、DevSecOps 流水线中的授权层质量门禁，尤其适合招聘系统、HR SaaS 等多租户\u002F多用户场景的权限验证。",2,"2026-07-17 02:30:11","CREATED_QUERY"]