Hi, I'd like to suggest a tool for the Authorization Testing section, if you're taking suggestions.
Aivist Verify (https://github.com/Aivist/Aivist-Verify) is a local CLI that confirms BOLA/IDOR findings. The section already covers the observe-and-replay side well — Autorize and AuthMatrix show you how responses differ across identities and roles, and then you judge the result yourself. This one sits a step after that: you hand it a single candidate (one endpoint, two identities) and it adjudicates that candidate in code, returning either a confirmation with a replayable evidence chain or an honest "not confirmed". A model reads the traffic and proposes a verdict, but a deterministic gate re-checks that proposal against the attack's own bytes and can only ever downgrade it, so a confident-sounding model answer can't become a confirmation on its own.
It's MIT licensed and written in Python. I validated it against OWASP crAPI and VAmPI rather than only my own test targets, and the runs are archived verbatim in the repo. That includes one case where it produced a real false positive on crAPI's public community feed, which was fixed and then re-verified against live crAPI — the archive keeps both the mistake and the fix. It also declines to confirm resources that every authenticated user can read, since black-box that's indistinguishable from a resource shared on purpose.
I'll follow up with a PR adding the entry in your existing format so you can see the exact diff. Happy for you to close either or both if it isn't a fit for the list.
Full disclosure: I'm the author.
Hi, I'd like to suggest a tool for the Authorization Testing section, if you're taking suggestions.
Aivist Verify (https://github.com/Aivist/Aivist-Verify) is a local CLI that confirms BOLA/IDOR findings. The section already covers the observe-and-replay side well — Autorize and AuthMatrix show you how responses differ across identities and roles, and then you judge the result yourself. This one sits a step after that: you hand it a single candidate (one endpoint, two identities) and it adjudicates that candidate in code, returning either a confirmation with a replayable evidence chain or an honest "not confirmed". A model reads the traffic and proposes a verdict, but a deterministic gate re-checks that proposal against the attack's own bytes and can only ever downgrade it, so a confident-sounding model answer can't become a confirmation on its own.
It's MIT licensed and written in Python. I validated it against OWASP crAPI and VAmPI rather than only my own test targets, and the runs are archived verbatim in the repo. That includes one case where it produced a real false positive on crAPI's public community feed, which was fixed and then re-verified against live crAPI — the archive keeps both the mistake and the fix. It also declines to confirm resources that every authenticated user can read, since black-box that's indistinguishable from a resource shared on purpose.
I'll follow up with a PR adding the entry in your existing format so you can see the exact diff. Happy for you to close either or both if it isn't a fit for the list.
Full disclosure: I'm the author.