PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

PimpMyBurp #2 – Auth Analyzer : How to test horizontal and vertical privileges escalation

yeswehack.com | vulnerability | #bug-bounty | #burp-suite | #privilege-escalation | #idor | #tooling | #auth-analyzer
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PimpMyBurp #2 covers Auth Analyzer, a Burp extension that replays requests across user sessions to detect horizontal and vertical privilege escalation and auto-swap CSRF tokens or session parameters.
Published
Collected

Related coverage

blog · netspi.com
Introducing Burp Extractor
Will Strei introduces Burp Extractor, a Burp Suite extension that extracts dynamic values like anti-CSRF tokens from responses via regex and reinserts them into requests, a generalized cookie jar.
blog · netspi.com
Beautifying JSON in Burp
A native Java Burp extension that beautifies JSON in place, letting testers read and live-edit nested API responses without Jython, with edits synced back to the raw request tab.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · portswigger.net
Backslash Powered Scanning: hunting unknown vulnerability classes
James Kettle presents backslash-powered scanning: an approach that finds known and unknown classes of server-side injection flaws with a tiny network footprint, tested across thousands of sites.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
vulnerability · blog.quarkslab.com
Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739)
Local privilege escalation in the Cato VPN Client through the split-tunnel upload flow, from named pipe to SYSTEM delete and Windows Installer rollback.
Back