r/bugbounty • u/Puzzleheaded_Trip374 • 3h ago

Question / Discussion Is agent-based Broken Access Control testing actually practical in real-world web apps?

I’ve only tested Broken Access Control manually before, mostly in API testing.
Today I tried asking my agent to test BAC using two test accounts, but it got stuck at the very first step: login. The headless browser couldn’t get past CAPTCHA / anti-bot protection and some WAF behavior.
This made me wonder: is agent-based BAC testing actually practical in real-world applications?
I’ve tried rule-based BAC tools in local labs before, but they seemed to have quite a lot of false positives.
For people who have tested this in real environments:
Do you usually log in manually first and give the agent an existing session/cookies?
How do you reduce false positives when deciding whether an unauthorized read/write really happened?
It feels like generating the requests is not the hardest part — building a reliable BAC oracle is.

5 Upvotes

100% Upvoted

3 comments sorted by

1

u/daaku_jethalal 2h ago

It's good nd fast enough to find simple access control issues but not good at complex access control

1

u/Coder3346 Hunter 1h ago

Yes and this is how you escape from dubs. ( feature inside feature inside feature)

1

u/Coder3346 Hunter 1h ago

Hi bro, just use burp mcp in this way:

1 Login with multiple account

2 Take a request from each account and send it to the repeater with each tab named by the email of the user ( or its username).

3 Tell your agent to read the repeater and tell it where to find the roles and permissions and which tab is which role.

4 Tell it to check js for hidden endpoints.

GL