Penjester

Scanners cannot find broken access control.

They only have one session.

A Burp Suite extension that replays every request as every other account, proves what it finds with three more, and tells you what it never tested.

01 · The gap

Every other bug class has a tool

SQL injection and XSS are decidable from one session: a payload either reflects or it does not. Scanners are good at them.

Authorization is not. To know /invoices/4471 is Alice's and Bob should not have it, you need Bob's session, Alice's session, and a notion of who owns what.

Which is why broken access control is #1 on the OWASP Top 10 and still found by hand.

A scanner sees
GET /invoices/4471 → 200

That is all it can see. It has one cookie jar
and no idea whose invoice that is.

02 · What it does

Watch · Replay · Prove · Account for it

Watch

Browse as each account. Every request is attributed to the session that carried it — including when two accounts use differently named cookies.

Replay

Every request goes out again as every other account, with the whole credential set exchanged — cookies, headers, body tokens, all three anti-forgery carriers.

Prove

A nonexistent identifier, a repeat, and a credential-free request. Then: was this account already entitled to the object anyway?

And then the part nobody builds: what was not tested, with the reason on every row.

03 · The difference

Evidence, not similarity

Two renders of one page are 93 % alike by construction — the chrome, the navigation, the scripts. Similarity proves nothing.

What proves something is the records: how many values that identify the owner's data came back, out of how many existed.

3 of 20 — a finding
0 of 20 — the control held
0 of 0 — the test said nothing, and says so

GET /api/teams/32567000000022002/details
owner zylker 200 59,534 B
actor okafor 200 57,021 B

93% alike, 4% apart
a scanner calls this a finding

owner-identifying values returned 0 of 20
it is not one

04 · The discipline

Disproven is a verdict, and it costs as much to earn

An IDOR on a UUID only matters if an attacker can get the UUID. Most tools shrug. Penjester searches.

Every response your account genuinely received is scanned for the victim's identifier, and the number searched is recorded.

Silence is not proof of absence. A searched silence is.

teamId (uuid)
would have to be leaked to the attacker

searched 412 responses
this account genuinely received

it appears in none of them

→ NOT REACHABLE · disproven

05 · The limits

What it refuses to do

No model composes a request. It chooses what to look at and what to write up. One function sends everything, and no model is on that path.
Nothing runs on its own. A run starts because somebody typed the command.
No credential reaches a prompt. The model is told cookie names. It cannot be handed a value.

No payload scanner. SQLi and XSS have good tools. This stays on the ground nothing else covers.
No severity score. Severity is demonstrated impact, and only somebody who knows what the data is can say it.
A skipped thing never looks like a clean thing. Every refusal is on the report.

06 · Where it stands

Built, tested, and in daily use

2,771logic assertions

1,282driver assertions

121MCP assertions

17Burp tabs

Everything Swing- or Burp-bound has its rule extracted into a pure function so it can be asserted without a Burp runtime. The test suite is the proof, not the screenshot.