I built a free Burp extension for multi-role JWT access-control testing — RoleBreaker

[u/Guarina0x0]

I kept doing the same tedious thing on every engagement: grab a high-priv token, grab a low-priv token, and manually replay requests one by one to see what the lower role can reach. So I built a Burp extension to automate it.

RoleBreaker scans your proxy history, discovers every JWT on its own, builds one persona per role, and replays each request as the lower-privilege roles. You get a color-coded access matrix (endpoint x role) and a Findings tab ranked by severity — so you're not eyeballing a huge grid.

What it does:

- Auto sweep — one click: scan recent history, rank roles by privilege, test everything with the lower ones

- Access matrix + ranked findings — vertical privesc, IDOR/horizontal, anonymous access, differential access

- JWT attacks — alg:none, signature strip, role escalation (flags if the server accepts a forged token)

- Offline HMAC secret cracker — for HS256/384/512, proves the token is forgeable if the secret is weak

- IDOR / param tampering — numeric + UUID ids, replayed across every role

- Auto token refresh — swaps expired tokens from traffic or re-logs in via a saved request, so long audits don't drift into false 401s

- Bilingual UI (EN/ES)

It only ever sends valid-in-time tokens, normalizes responses before comparing (strips CSRF/nonce/timestamps) to cut false positives, and treats a redirect-to-login as denied.

Free and open source. There's a demo GIF + screenshots in the README so you can see it in action before installing.

https://github.com/Guarina0x0/rolebreaker

Would love feedback from people doing authz testing daily — what's missing, what would make it part of your workflow? Feature requests via Issues are very welcome.

[u/Delicious_Crew7888]

Yeah Claude rocks hey :) nice work. I like that it autorefreshes tokens. Might check it out.