Auth Crawl
auth_crawlCrawl an authenticated application session to map post-login pages and extract URLs with object references for access-control testing.
Instructions
[AGGRESSIVE — requires human approval] Crawl an application as a registered session and map what is behind the login.
session names a session from session_register; it is only sent to the
host it was issued for.
Before crawling, the entry point is fetched with and without the session. If the two responses are identical the session authenticates nothing, and the crawl is refused — a list of public pages labelled "authenticated surface" would poison every conclusion drawn from it.
When a page turns out to be a single-page-app shell, its same-origin script
bundles are fetched and mined for paths — API literals, request call sites,
and the route table. Those become crawl seeds under the same guards as a
link, and are counted separately in coverage so it is visible how much
of the map a link crawler alone would have missed. max_bundles bounds
the extra requests.
Returns the discovered URLs, the forms found (read-only ones submitted with
empty values, state-changing ones reported and never touched), and — the
useful part — the URLs carrying an object reference, which is what
authz_compare must be pointed at. A URL with no identifier in it belongs
to everyone and proves nothing about access control.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| session | Yes | ||
| timeout | No | ||
| max_depth | No | ||
| max_pages | No | ||
| max_bundles | No | ||
| liveness_every | No | ||
| max_form_submissions | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||