What problem does it solve? Security testers need a disciplined, evidence-gated workflow to verify whether login, registration, invitation, role-check, SSO callback, and API identity boundaries actually hold on a server, without producing false positives from UI redirects, caches, or scanner noise. ## Core Features & Use Cases - Engagement Gating: Enforces declared authorization, locked scope, and host/identity/path baselines before any probe, using only owned accounts, objects, and approved rates. - Identity Matrix Testing: Builds anonymous, low-privilege, and high-privilege owned identities and runs single-variable differential probes against protected resources. - Oracle-Based Validation: Accepts findings only when a server response, authoritative GET, or audit log confirms unauthorized access; treats WAF blocks, captchas, and single 200s as inconclusive. - Use Case: During an authorized assessment, verify whether a low-privilege test account can read another owned object's protected data, then route object-ID findings to IDOR analysis and session findings to session testing. ## Quick Start Use hunt-auth-bypass to plan an evidence-gated validation of the login and role-check endpoints on my authorized test target using my two owned test accounts.
