Automating Permission Checks Using OpenAPI Security Scanner?
GitLab Project Link: https://gitlab.com/ngalog-gitlab/open...
GitHub Project Link: https://github.com/ngalongc/openapi_s...
Authorization security issues in modern web applications could not be easily picked up by security scanners.
One of the reasons is that the security scanners mainly looking for SQLi, XSS, RCE instead of looking for authorization security bugs, and the scanners usually do not have knowledge of how the web application is supposed to behave. That's why the majority of the authorization bugs now are mainly discovered manually.
OpenAPI Security Scanner is created to help to discover authorization security issues with both automation and manual review. Hopefully you can find your next bug using this API scanner.