Map identities
Users, service identities, roles, tokens and the trust between them.
AUTHORIZATION SECURITY TESTING
Authorization security testing across the whole chain.
Authorization fails in the gaps between components that each assume another one checked. Testing it needs a model of identities, roles, tokens and tenant boundaries.
What it means.
Authorization security testing (IDOR/BOLA, privilege escalation, tenant-isolation) checks whether a lower-privileged actor or untrusted input can exceed intended authority. 0day Factory maps the authority chain and proves where it breaks.
The approach.
Test the gaps
Probe whether untrusted input reaches actions beyond intended authority.
Prove the breach
Reconstruct actor → identity → authz point → resource → outcome with evidence.
Questions, answered.
Do you test tenant isolation?
Yes. Tenant-boundary crossing is a primary target. The platform itself is built on database row-level isolation, and proving whether your boundaries hold is a core use case.
Prove which weaknesses can actually become attacks.
Request access and see a de-identified investigation: hypothesis, path, safe validation, evidence and re-test.