Authz0 is an automated authorization testing tool that detects unauthorized access by leveraging URL and role-based credential templates.
🔑 Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.
This tool is primarily used by security professionals and application testers to automate the detection of authorization vulnerabilities in web applications. By managing URLs, roles, and credentials through YAML templates, users can systematically verify access controls and identify unauthorized access scenarios efficiently.
Users should prepare YAML-based templates for URLs, roles, and credentials to maximize the tool's effectiveness. Importing URL data from tools like ZAP and Burp Suite can streamline template creation. Running scans with appropriate authentication headers and cookies is crucial to accurately simulate different user roles and detect unauthorized access. Integration with Docker and GitHub Actions facilitates automation in CI/CD pipelines.
Install via Go: go install github.com/hahwul/authz0@latest
Install via Homebrew: brew tap hahwul/authz0
Install via Homebrew: brew install authz0authz0 new <filename> [flags]
Generate a new scan template including URLs, roles, and credentials.
authz0 new target.yaml --include-urls urls.txt
Create a new template including URLs from a text file.
authz0 new target.yaml --include-zap zapurls.har
Create a new template including URLs from a ZAP HAR file.
authz0 new target.yaml --include-burp burpurl.xml
Create a new template including URLs from a Burp Suite XML file.
authz0 setUrl <filename> -u <URL>
Add or modify a URL in the existing scan template.
authz0 setRole <filename> -n <RoleName>
Add or modify a role in the existing scan template.
authz0 setCred <filename> -n <RoleName> -H "Header: Value"
Add or modify credentials (headers) for a specific role in the template.
authz0 scan <filename>
Run an authorization scan using the specified template.
authz0 scan <filename> -r <RoleName> -H "Cookie: value" -H "X-API-Key: key"
Run a scan with specific role and additional authentication headers.
authz0 completion
Generate shell autocompletion scripts.
authz0 version
Display the current version of authz0.