AccessContextFuzzer

AccessContextFuzzer is a Burp Suite extension built on the Montoya API, designed for researchers and pentesters who need to systematically test for access control bypass and Web Cache Deception (WCD) vulnerabilities. Instead of manually crafting dozens of header and path variations, it automatically generates and tests hundreds of bypass variants in seconds — then highlights exactly which ones behave differently from the baseline. Three independent fuzzing engines cover HTTP header manipulation, URL path bypass, and selection-targeted fuzzing, all under a single, unified interface.

What's New in v2.4.0

• Automatic MISS→HIT confirmation — When a variant returns a cacheable 200 X-Cache: MISS with max-age/s-maxage, the scanner resends the same request a few times inside the cache window. If X-Cache flips to HIT, the row is flagged 🎯 WCD CONFIRMED (MISS→HIT) — the cache-warming step is now automatic instead of a manual Repeater round-trip.
• Rewritten Verify WCD (right-click) — First warms the cache with your current auth until the entry is HIT, then replays without cookies/auth and compares bodies. A confirmed leak requires a no-auth HIT whose body matches the authenticated response — cleanly separating ✅ CONFIRMED WCD from ⚠️ HIT but content differs and ❌ not cached without auth.
• New 🎯 WCD Findings tab — A dedicated tab collects every WCD result (automatic MISS→HIT confirmations and manual verifications) with URL, auth/no-auth status, X-Cache, verdict, and timestamp. Double-click a row to open the request/response that proves it.
• Turkish-locale cache detection fix — On a Turkish-locale JVM, "hit".toUpperCase() yields "HİT", so every X-Cache / Cache-Control comparison now uses Locale.ROOT. Previously cacheable responses were wrongly reported as MISS.

Installation

Requirements: Burp Suite (Professional or Community) 2023.1+ and Java 17+

Download the latest access-context-fuzzer-*-jar-with-dependencies.jar from the GitHub Releases page, then in Burp Suite go to Extensions → Add, set the extension type to Java, and select the file. An Access Context tab appears in the toolbar.

Context Menu Integration

Right-click any request in Proxy → HTTP History and choose Access Context: Header Fuzz, Path Fuzz, or Fuzz Selection to load it directly into the correct engine tab and begin fuzzing.

Three Fuzzing Engines

1. Header Bypass

Tests IP spoofing and host manipulation across 40+ header variants including X-Forwarded-For, X-Real-IP, X-Client-IP, True-Client-IP, and CF-Connecting-IP. Also covers host override (X-Forwarded-Host, X-Host, X-Original-Host), WebDAV/method swap, Content-Type override, and HTTP/2 pseudo-header injection (:authority, :path). Custom IPs and Header: Value pairs can be loaded from a wordlist. Targets systems that enforce trusted-IP checks or internal-network access controls.

2. Path/GET Bypass

Applies URL encoding, double encoding, IIS Unicode normalization, case flipping, dot-segment injection (/..;/admin), double-slash prefix (//admin), overlong UTF-8, and WCD-specific path techniques. Includes X-Rewrite-URL, X-Original-URL, and Nginx/OpenResty X-Accel-Redirect rewrite tricks. A CDN profile selector (Cloudflare, Akamai, Fastly, CloudFront, Nginx, Varnish) filters delimiter payloads to the target's known delimiter set, and a body-carrying Fat GET option surfaces WCD vectors that path-only testing misses.

3. Selection Fuzz

Focuses fuzzing on a specific text selection within a request, applying URL encode, double URL encode, IIS Unicode, fullwidth-slash, and custom-payload transformations. Supports loading custom wordlists from file for fully customized fuzzing campaigns.

Web Cache Deception Pipeline

Web Cache Deception (WCD) is a class of vulnerability where authenticated pages are cached and served to unauthenticated users, leaking sensitive data. AccessContextFuzzer automates the full attack chain in four phases:

• Delimiter Discovery — Identifies which characters the origin server treats as path delimiters (?, #, %23, %3f, etc.).
• Delimiter + Extension — Combines discovered delimiters with static extensions (19 file types incl. .js, .css, .png) to trigger caching, including the /path/abc.js path-mapping vector.
• Normalization Discrepancy — Detects path-normalization differences between origin and cache using encoded dot-segments (..%2f, %252f, %c0%af, %00.css).
• Exploit Generation — Synthesizes all findings into a working WCD payload (/my-account%23%2f%2e%2e%2fresources → 200 + X-Cache:hit).

📚 New to WCD? Read Web Cache Deception & Poisoning to understand the theory behind every phase above.

Smart Results Analysis

Results are displayed in a color-coded, sortable table with a dedicated Cache column showing HIT ✅, MISS, PRIVATE 🚫, NO-STORE 🚫, or HIT/Vary:Cookie. Automatic anomaly detection is flagged in the Notes column:

• 🎯 POTENTIAL BYPASS — 40x baseline changed to 2xx (strong bypass signal)
• 🔀 REDIRECT BYPASS? — 401/403 baseline changed to a 30x redirect
• ⚠️ BODY_BYPASS? — Same 2xx status but the body content changed
• BODY_DIFF — Content difference detected via MD5 hash comparison
• SENSITIVE_DATA:JWT — JWT/CSRF/Bearer/API-key/email detected in the body (highlighted pink)
• CUSTOM:LABEL — A user-defined regex=LABEL rule from the Settings tab matched

Additional reliability features: automatic baseline re-verification every 50 requests (session-drift detection), real-time duration estimate via RTT averaging, and adaptive rate-limit protection on 429/503 responses. The 🔍 Show Only Interesting filter hides baseline noise so a single click reveals the bypass.

Parallel Fuzzing & Productivity

Toggle Parallel Mode in the ⚙ Settings & History tab to send requests concurrently with a configurable thread count (2–20). Also included: one-click scan profiles (⚡ Quick Scan, 🔥 Full Scan, 🎯 WCD Only), a 👁 Preview Payloads button that lists every variant before running, a side-by-side Response Diff Viewer against the baseline, and a Scan History log of every completed run.

Request/Response Viewer

Double-click any row to open Burp's native HTTP editors (Montoya HttpRequestEditor / HttpResponseEditor) in a non-modal split pane. Raw, Pretty, Hex, and Render tabs provide complete inspection — the Render tab shows a live HTML preview so you can spot API keys or tokens without reading raw HTML.

OPSEC Verification

A built-in OPSEC module confirms your external IP before testing begins; if the IP is unverified, the extension blocks fuzzing to prevent accidental exposure of your real IP. A single, persisted Delay (ms) shared by all engines lives in the Settings tab.

Export & Integration

Multi-select rows (Ctrl/Shift+Click) and use Send All Selected or Send All Interesting to push them to Repeater, save results with Export CSV, and note that all fuzzing requests are natively added to Burp's Site Map.

Building from Source

git clone https://github.com/Tagoletta/AccessContextFuzzer.git
cd AccessContextFuzzer
mvn compile
mvn package
# Output: target/access-context-fuzzer-2.4.0-jar-with-dependencies.jar

Requires JDK 17+ and Maven 3.6+. The source is organized into a modular burp.core, burp.util, burp.payload, and burp.ui package structure.

Lab-Proven Effectiveness

AccessContextFuzzer successfully solves official PortSwigger Web Security Academy labs:

• URL-based access control can be circumvented — root-level URL rewrite via X-Original-URL
• Host header authentication bypass — host manipulation via X-Forwarded-Host
• Authentication bypass via information disclosure — custom X-Custom-IP-Authorization: 127.0.0.1 header
• Exploiting cache server normalization for WCD — delimiter + encoded dot-segment + cache prefix (Cache Deception Combos)

GitHub