# Quitten/Autorize

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

Repository: https://github.com/Quitten/Autorize
Canonical: https://ross.abutalabs.com/products/autorize
Language: Python
License Family: other
Topics: authorization, authorization-enforcement, burpsuite, burp-plugin, jython, application-security
Last push: 2026-03-21T06:00:34+00:00

## Health v2 (maintenance only)
Score: 56/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 73, release rhythm 8, longevity 100
- inputs: {"age_days": 4219, "days_push": 165, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1169, forks 252 (observed 2026-08-28T04:03:51.046575+00:00)

## What it is
Autorize is a Burp Suite extension, written in Jython, that automatically detects authorization and authentication enforcement flaws in web applications. It replays high-privileged user requests with low-privileged or unauthenticated contexts and analyzes responses to identify broken access controls such as IDORs.

## Use cases
- detect authorization bypasses in web apps
- find IDOR vulnerabilities automatically
- test role separation between admin and regular users
- identify endpoints missing authentication
- verify backend authorization logic consistency
- automate access control testing during pentests

## When to choose
- you are a penetration tester or appsec engineer testing authenticated web applications
- you need to automate authorization enforcement checks instead of manual request replay
- you already use Burp Suite and want passive IDOR/broken access control detection

## When to avoid
- you are not using Burp Suite or cannot set up the Jython environment
- you need automated scanning outside of an authenticated proxy-driven workflow
- you require a standalone CLI or CI/CD-integrated DAST tool

## Facets
- artifact type: plugin
- maturity: active
- function: authorization, security, penetration-testing, vulnerability-scanning, http-client
- domain: security, penetration-testing, web-development, developer-tools
- platform: cross-platform, jvm, python
- tags: burp-suite, burp-extension, jython, authorization-testing, idor, access-control, bapp-store, web-app-security

## Member repositories
- Quitten/Autorize (main) score 56

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:51.046575+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:28:39.973484+00:00, confidence not recorded.
  - readme: https://github.com/Quitten/Autorize (fetched 2026-08-28T04:03:51.046575+00:00, sha 2f9da19e873f)
- Data as of 2026-08-30T08:39:29.467469+00:00.