USE CASE / AUTHORIZATION
Prove where authorization actually fails.
Authorization is where identity, application logic and infrastructure meet — and where the most damaging attack paths hide. Testing it needs a model of users, service identities, roles, tokens, tenant boundaries and the trust relationships between them.
Authorization is a system property, not a checkbox.
A model deciding not to call a tool is not authorization. Neither is a UI that hides a button. Real authorization is enforced across the request path — and it fails in the gaps between the components that each assume another one checked.
0day Factory maps identities and their privileges, then tests whether untrusted input or a lower-privileged actor can cause actions beyond intended authority.
Reconstruct the authority chain.
Questions, answered.
Do you test multi-tenant isolation?
Yes — tenant-boundary crossing is a primary authorization target. The platform itself is built on database row-level isolation, and testing whether your boundaries hold is a core use case.
Prove which weaknesses can actually become attacks.
Request access and see a de-identified investigation: hypothesis, path, safe validation, evidence and re-test.