authz0

README

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.

URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers and cookies with a template file created/generated once.

🛸 Key Features

• Generate scan template $ authz0 new
  • Include URLs
  • Include Roles
  • Include ZAP history (Select URLS > Save Selected Entiries as HAR)
  • Include Burp history (Select URLs > Save item)
  • Include HAR file
• Easy modify scan template (Role, URL) $ authz0 setUrl $ authz0 setRole authz0 setCred
• Scanning authorization(access-control) with template $ authz0 scan

🚀 Installation

go install

go install github.com/hahwul/authz0@latest

homebrew

brew tap hahwul/authz0
brew install authz0

Need more information? please refer to installation guide

🛸 Usage

Available Commands:

  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  new         Generate new template
  scan        Scanning
  setCred     Append Credential to Template
  setRole     Append Role to Template
  setUrl      Append URL to Template
  version     Show version

1. Generate template

authz0 new <filename> [flags]

e.g

authz0 new target.yaml --include-urls urls.txt
authz0 new target.yaml --include-zap zapurls.har
authz0 new target.yaml --include-burp burpurl.xml

2. Modify template

authz0 setCred <filename> [flags]
authz0 setRole <filename> [flags]
authz0 setUrl <filename> [flags]

e.g

authz0 setUrl target.yaml setUrl -u https://www.hahwul.com
authz0 setRole target.yaml -n User1
authz0 setCred target.yaml -n User1 -H "X-API-Key: 1234" -H "TestHeader: 12344"

3. Scanning

authz0 scan <filename> [flags]

e.g

authz0 scan target.yaml
authz0 scan target.yaml -r TestUser1 -H "Cookie: 1234=1234" -H "X-API-Key: 1234555"

📖 Documents

https://authz0.hahwul.com

🤔 Question

Please use discussions actively!

📌 Changelog

Detailed changes for each release are documented in the release notes.

❤️ Contributing

Authz0's open-source project and made it with ❤️ if you want contribute this project, please see CONTRIBUTING.md and Pull-Request with cool your contents.

Documentation

Overview

Copyright © 2022 HAHWUL

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.