wtf is authz-exec?

Authz-ExeC is an add-on for Burp Suite, a tool security professionals use to test websites and APIs for weaknesses. This particular add-on focuses on one specific problem: making sure a user can only access their own data and not someone else's, or data that only a higher privileged account should see. It works by taking a request you already made as a privileged, full access user, and automatically replaying that same request using other identities you set up, such as a low privilege account, a different customer or tenant account, or no login at all. It then compares the three responses to each other. If a low privilege identity gets back the same result as the privileged one, while the no-login version is properly refused, that is a real access control problem, shown as a red result in a color coded grid where rows are the endpoints tested and columns are the identities. Other colors mark cases where access was correctly blocked, cases that need a human to look closer, or cases where a firewall simply blocked the request rather than the application itself handling it. To reduce false alarms, it strips out things like timestamps and random tokens before comparing responses, checks how similar the structure of two responses actually is, and can use planted marker strings to catch cases where one tenant's data leaks into another tenant's response. It also understands GraphQL style APIs and can test JSON, file, and XML responses, not just regular web pages. Setting it up requires Burp Suite, either the paid Professional edition or the free Community edition, and either downloading a ready made file or building it yourself with a Java 17 or newer development kit. Once loaded, you configure the identities you want to test, set the scope of what the tool is allowed to touch, and then either replay past browsing history or browse the target live as a privileged user. This is a specialist tool built for security researchers and penetration testers doing authorized testing of access controls, not for general developers or non-technical users. It is released under the MIT license.