AI 中文总结
AuthProbe是开源黑盒扫描器，基于OpenAPI规范，以多身份检测招聘API中对象级授权漏洞。能发现身份合法拥有的对象，检测跨身份读取、枚举等问题，在合成API上无误报，运行时间线性增长，以Apache 2.0许可发布。
AI 中文摘要
自2019年以来，对象级授权漏洞（BOLA）一直位居OWASP API安全排名榜首，是招聘技术中申请人数据大量泄露的根源。其恶意请求与合法请求难以区分，导致Web应用防火墙和单身份扫描器无法检测。AuthProbe是一种开源黑盒扫描器，通过OpenAPI规范驱动测试，以多个身份检测HTTP API中的BOLA和IDOR。它为每个身份发现合法拥有的对象，尝试以其他身份读取对象并通过与真实所有者获取的基准响应比较来确认泄漏。还能检测枚举、报告缺失认证等。在合成招聘API上，AuthProbe能无误报地检测所有植入的跨身份读取，运行时间随测试对象数量线性增长，且以Apache 2.0许可发布并带有授权使用护栏。
英文摘要
Broken Object-Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), has topped the OWASP API Security ranking since 2019 and is the root cause of some of the largest exposures of applicant data in recruitment technology. The defining feature of this flaw class is that a malicious request is byte-for-byte indistinguishable from a legitimate one, which is precisely why web application firewalls and single identity scanners fail to catch it. We present AuthProbe, an open-source, black-box scanner that detects BOLA and IDOR in HTTP APIs by driving its tests from an OpenAPI specification and by acting under two or more identities that the operator controls. AuthProbe discovers, for each identity, the objects that identity legitimately owns, then attempts to read one identity's objects while authenticated as another and confirms a leak by comparing the response against a ground-truth fetch by the true owner. It also walks predictable identifiers to expose enumeration and reports missing authentication and existence oracles. The tool returns a severity-thresholded exit code and machine-readable reports so that it can gate a continuous integration build. On a synthetic recruitment API in which the McHire failure class is reproduced, AuthProbe detects every planted cross-identity read with no false positives on a hardened counterpart, and its running time grows linearly with the number of objects under test. AuthProbe is released under the Apache 2.0 license with an authorized-use guardrail.
Comments10 pages, 3 figures, 4 tables
