A Burp Suite extension that automates cross-tenant IDOR / broken object-level authorization testing in multi-tenant web applications.
Manually testing tenant isolation means repeating the same request with a different tenant's session/cookie and eyeballing whether the response leaks data. This extension automates that comparison and gives a clear verdict.
- Capture a request in Burp Repeater (as Tenant A)
- Right-click the request → "Send to Tenant Isolation Mapper"
- Go to the TIM tab, enter Tenant B's cookie / auth header
- Click Run Probes
- The extension re-sends the request as Tenant B and compares the response against the original
- Get a verdict:
VULNERABLE,LIKELY_VULNERABLE, orNOT_VULNERABLE
- Open Burp Suite → Extensions tab → Installed → Add
- Extension type: Java
- Extension file: select the built
.jar(built fromsrc/) - Click Next — a new TIM tab appears in Burp's top menu
- Send any authenticated request to Repeater
- Right-click → Send to Tenant Isolation Mapper
- In the TIM tab, fill in:
- Tenant B Cookie — a second tenant/user's session cookie
- Tenant B Auth Header (optional) — for bearer-token apps
- Similarity threshold — default
0.85
- Click Run Probes
- Review the Verdict and Reasons columns
- Click Export HTML Report to save a shareable report
demo/vuln_server.py is a minimal Python HTTP server used to validate the
extension locally:
/api/invoice/1001— no ownership check (intentionally vulnerable)/api/document/9001— checks the cookie before returning data (safe)
Run it with:python3 demo/vuln_server.py
Then test both endpoints through the extension — one should return
VULNERABLE, the other NOT_VULNERABLE.
See docs/tim_report.html for a real exported report from the demo run.
- Java, Burp Extender/Montoya API
- Response similarity-based verdict classification
Built for authorized security testing and bug bounty research only. Do not use against systems you don't have explicit permission to test.