LeakRadar

Open-Core API Security Engine for Automated BOLA & IDOR Vulnerability Scanning

⚡ Overview

LeakRadar is an open-core DAST scanner designed specifically for REST APIs. It detects Broken Object Level Authorization (BOLA / IDOR) defects, token privilege escalation, and exposed secrets with near-zero false positives using a cross-token pairwise heuristic matrix algorithm.

                        LeakRadar Vulnerability Summary                        
+-----------------------------------------------------------------------------+
| Endpoint             | Params               | Status | Overlap | Confidence |
|----------------------+----------------------+--------+---------+------------|
| /api/v1/patients/{p} | {"patient_id":       |  200   |  100.0% |    HIGH    |
|                      | "REC-9901"}          |        |         |            |
+-----------------------------------------------------------------------------+
[3/3] Generating redacted proof-of-concept reports...
Saved Markdown PoC: demo_findings/bola_api_v1_patients_patient_id_records.md
+--------- Scan Finished ---------+
| Scan Completed Successfully!    |
| Total Findings: 1               |
+---------------------------------+

🌟 Key Features

• 3-Baseline Volatility Diffing: Prunes volatile fields (timestamps, nonces, session IDs) across triple User A baselines before cross-token evaluation.
• JWT Claim Harvesting: Automatically parses bearer token claims (sub, user_id, email) to seed parameterized endpoints (/api/v1/patients/{patient_id}).
• Cross-Token Replay Matrix: Replays harvested endpoints using User B's identity, evaluating leaf-level scalar field overlap, ID echoing, and ownership matches.
• Payload Secret Scanner: Integrated Shannon entropy analysis ($\ge 4.5$) and regex rules for AWS keys, Stripe tokens, private keys, and API credentials.
• Redacted PoC Deliverables: Exports Markdown & Executive PDF reports with auto-redacted authorization tokens and proof steps.

🚀 Quick Start

Installation

git clone https://github.com/Ajmax76/leakradar.git
cd leakradar
pip install -e .

Run BOLA Vulnerability Scan

leakradar scan \
  --base-url "http://127.0.0.1:8000" \
  --spec "http://127.0.0.1:8000/openapi.json" \
  --token-a "Bearer eyJhbGci..." \
  --token-b "Bearer eyJhbGci..." \
  --output "./findings"

📖 Step-by-Step Usage Guide

Step 1: Obtain 2 User Tokens

To detect BOLA / IDOR defects, LeakRadar tests if one user can access another user's private data. You need two authorization tokens:

• Token A (--token-a) [VICTIM]: The Bearer token for User A (e.g. Dr. Sarah Jenkins). LeakRadar uses this token to fetch baseline responses and discover resource IDs (like patient_id: REC-9901).
• Token B (--token-b) [ATTACKER]: The Bearer token for User B (e.g. Alex Miller). LeakRadar replays User A's requests using User B's token to check if User B is improperly granted access.

Step 2: Run the Scan Command

Execute leakradar scan against your target API server and OpenAPI specification.

🛠️ Command Parameter Breakdown

📊 Feature Matrix (Community vs Pro Auditor vs Enterprise)

🏢 Enterprise & Custom Licensing

For organizations requiring custom capabilities, the Enterprise Tier provides:

• Custom Auth Adapters: Tailored support for complex authentication flows (Okta SSO, mTLS, custom header handshakes, dynamic CSRF tokens).
• Air-Gapped & On-Prem Deployment: Private execution within isolated corporate networks without external licensing checks.
• Organization-Wide Rights: Unlimited security team members and automated CI/CD pipeline scanning rights.
• Bespoke Compliance Deliverables: Customized executive PDF reports mapped to SOC2, ISO27001, or HIPAA requirements.

🧪 Local Demo Target

A vulnerable BOLA REST API testbed is provided in demo_target/app.py. It includes:

• Authentication Endpoint (/api/v1/auth/login): Issues standard 3-part Bearer JWT tokens for two distinct users (user_101 and user_102).
• Two Vulnerable BOLA Endpoints: GET /api/v1/patients/{patient_id}/records and GET /api/v1/users/{user_id}/profile (both handlers decode the caller's JWT identity, but fail to verify resource ownership).
• One Secured Control Endpoint: GET /api/v1/users/{user_id}/billing (decodes caller identity AND enforces ownership checks, returning 403 Forbidden on mismatch to verify false positive suppression).

# Start the demo target REST API
python demo_target/app.py

📄 License & Commercial Terms

The core open-source codebase is licensed under the verbatim PolyForm Noncommercial License 1.0.0.

• Non-Commercial Use: Free for security researchers, academic evaluation, and non-commercial vulnerability testing.
• Commercial Use: Using LeakRadar for paid client security audits, managed security services (MSSP), or commercial products is governed by our Commercial Terms.

Note: Organizations deploying LeakRadar commercially should conduct formal legal review of commercial licensing agreements.