This is an actively maintained fork of the original AuthMatrix project by SecurityInnovation. The original project appears to be unmaintained (last commit in 2018). This version is dedicated to fixing outstanding bugs, incorporating modern Burp Suite logic, and adding essential features for modern web security testing.
AuthMatrix is a Burp Suite extension designed to help security testers identify authorization vulnerabilities. It provides a simple and intuitive way to test complex, matrix-based access control models in web applications and web services.
This extension allows testers to define a set of users, roles, and "chains" (requests) to verify that an application's authentication and authorization controls are working as intended.
Here is a look at the new buttons:
This version includes all the original functionality of AuthMatrix, plus the following enhancements:
1. ✅ Bug Fix: Single Request Logic:
Original Issue: Sending a request to AuthMatrix often triggered two redundant requests.
Fix: Corrected the logic to ensure only a single request is sent, reducing noise and preventing potential side effects on the target server.
2. ✅ GUI Performance & Stability Fixes (Special Thanks to @Abyssraven0x13):
Fixed GUI Freeze & NullPointerException: Corrected the getTableCellRendererComponent logic to verify the existence of the setSelected method before execution, preventing crashes in certain Burp Suite environments.
Fixed Typos & Logic Errors: Resolved a naming error where selfelfExtender was used instead of selfExtender, ensuring proper row selection and menu functionality.
3. 🧹 Clear Auth & Re-import: Easily clear all Cookie and Authorization headers from your requests with a single click.
How to use: Click the "Clear Auth & Re-import" button to reset session tokens before starting a new test matrix.
4. ✂️ Remove Body Parameters Designed for cases where sensitive tokens or parameters are passed in the HTTP Body (supports x-www-form-urlencoded and JSON).
How to use: 1. Click "Remove Body Param". 2. Enter the name of the parameter you want to clear. 3. The extension will automatically set that parameter's value to empty for all requests.
4. 🔄 Dynamic New Data (Body Injection) Perfect for testing Broken Access Control when servers require specific user tokens or IDs within the HTTP Body.
How to use:
- Click "New Data" and enter the target parameter name.
- A dialog will appear for each user; enter the specific value intended for that user.
- During the scan, each user will send the request with their uniquely assigned parameter value in the body.
We are working on submitting this updated version to the PortSwigger BApp Store. For now, please use the manual installation method below.
- Clone this repository:
git clone https://github.com/earth11411/AuthMatrix.git
- Go to the Extensions tab in Burp Suite.
- Click Add.
- Select "Python" as the Extension type.
- Load the generated
AuthMatrix.pyfile from the git directory.
Contributions are very welcome! If you find a bug, have a feature request, or want to improve the code, please:
- Fork this repository (the new one, not the original).
- Create a new branch for your feature or bugfix.
- Submit a Pull Request with a clear description of your changes.
This project is licensed under the Apache License 2.0, in accordance with the original project.
This is a derivative work of the original AuthMatrix. The original LICENSE file and notices from the SecurityInnovation repository are preserved in this project as required.