# Authz0 | An Automated Authorization Test Tool

**URL:** <https://onehack.st/t/authz0-an-automated-authorization-test-tool/216006>\
**Category:** Tools & Scripts\
**Tags:** learning, tools\
**Created:** [March 6, 2022, 8:05am UTC](https://onehack.st/t/authz0-an-automated-authorization-test-tool/216006 "2022-03-06T08:05:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [March 6, 2022, 8:05am UTC](https://onehack.st/t/authz0-an-automated-authorization-test-tool/216006/1 "2022-03-06T08:05:51Z")

</div>

# 

[![](https://user-images.githubusercontent.com/13212227/149369752-8b344201-ebc4-43b2-8d64-b1229a5ee4c2.png)](https://github.com/hahwul/authz0/blob/main)

[![](https://camo.githubusercontent.com/f5054ffcd4245c10d3ec85ef059e07aacf787b560f83ad4aec2236364437d097/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f636f6e747269627574696f6e732d77656c636f6d652d627269676874677265656e2e7376673f7374796c653d666c6174)](https://github.com/hahwul/authz0/blob/main/CONTRIBUTING.md) [![](https://camo.githubusercontent.com/11f61a501c1c3938c04658728c74086a3b34d9b2d005e519fd9a8555ed88bebb/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f68616877756c2f617574687a30)](https://goreportcard.com/report/github.com/hahwul/authz0) [![](https://github.com/hahwul/authz0/actions/workflows/go.yml/badge.svg)](https://github.com/hahwul/authz0/actions/workflows/go.yml) [![](https://camo.githubusercontent.com/334197d15a5a0f3246351fae457436876cb550d5e08941013d0e8f43a40526e1/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f68616877756c3f7374796c653d666c6174266c6f676f3d74776974746572)](https://twitter.com/intent/follow?screen_name=hahwul)

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.

URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers and cookies with a template file created/generated once.

[![authz0-2](https://user-images.githubusercontent.com/13212227/149650143-a34d8826-f272-4aca-b9a7-323de268cd52.jpg)](https://user-images.githubusercontent.com/13212227/149650143-a34d8826-f272-4aca-b9a7-323de268cd52.jpg)

## 🛸 Key Features

- Generate scan template `$ authz0 new`
  - Include URLs
  - Include Roles
  - Include ZAP history (Select URLS \> Save Selected Entiries as HAR)
  - Include Burp history (Select URLs \> Save item)
  - Include HAR file

- Easy modify scan template (Role, URL) `$ authz0 setUrl` `$ authz0 setRole` `authz0 setCred`
- Scanning authorization(access-control) with template `$ authz0 scan`

## 🚀 Installation

_go install_

```auto
go install github.com/hahwul/authz0@latest

```

_homebrew_

```auto
brew tap hahwul/authz0
brew install authz0

```

Need more information? please refer to [installation guide](https://authz0.hahwul.com/installation.html)

## 🛸 Usage

**Available Commands:**

```auto
  completion Generate the autocompletion script for the specified shell
  help Help about any command
  new Generate new template
  scan Scanning
  setCred Append Credential to Template
  setRole Append Role to Template
  setUrl Append URL to Template
  version Show version

```

### 1. Generate template

```auto
authz0 new <filename> [flags]

```

e.g

```auto
authz0 new target.yaml --include-urls urls.txt
authz0 new target.yaml --include-zap zapurls.har
authz0 new target.yaml --include-burp burpurl.xml

```

### 2. Modify template

```auto
authz0 setCred <filename> [flags]
authz0 setRole <filename> [flags]
authz0 setUrl <filename> [flags]

```

e.g

```auto
authz0 setUrl target.yaml setUrl -u https://www.hahwul.com
authz0 setRole target.yaml -n User1
authz0 setCred target.yaml -n User1 -H "X-API-Key: 1234" -H "TestHeader: 12344"

```

### 3. Scanning

```auto
authz0 scan <filename> [flags]

```

e.g

```auto
authz0 scan target.yaml
authz0 scan target.yaml -r TestUser1 -H "Cookie: 1234=1234" -H "X-API-Key: 1234555"

```

## 📖 Documents

[https://authz0.hahwul.com](https://authz0.hahwul.com/)

## 🤔 Question

Please use [discussions](https://github.com/hahwul/authz0/discussions) actively!

## 📌 Changelog

Detailed changes for each release are documented in the [release notes](https://github.com/hahwul/authz0/releases).

## ❤ Contributing

Authz0’s open-source project and made it with ❤ if you want contribute this project, please see [CONTRIBUTING.md](https://github.com/hahwul/authz0/blob/main/CONTRIBUTING.md) and Pull-Request with cool your contents.

## GitHub:

[https://github.com/hahwul/authz0](https://github.com/hahwul/authz0)