Skip to content

v4.6.15

Choose a tag to compare

View all tags
@xalgord xalgord released this 02 Sep 07:48
· 9 commits to main since this release
v4.6.15
d232340

v4.6.15 — Two-account IDOR/BOLA from a second ingested session

Added

  • ingest_har can now register a SECOND account (role=b) for true two-account IDOR/BOLA. Proving broken object-level authorization needs two real identities: one user's session reaching another user's objects. Capture a HAR while logged in as a second user and run ingest_har path=… role=b — its session is registered as role B (a dedicated store that is deliberately not auto-applied to http_request, since role B is the "other user" identity used on purpose). authz_matrix then uses that ingested session as role B (when no operator second account is configured, mirroring how role A already falls back to an ingested session), replaying each request as role A, role B, and anonymous to flag any of role A's resources that role B can reach. Role-B ingestion registers credentials only — it does not seed the ledger, since role B is a comparison identity, not new attack surface.

Binaries: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 (v4.6.15, stripped).

Full changelog: https://github.com/xalgorix/xalgorix/blob/main/CHANGELOG.md

Assets 6
Loading