AccessContextFuzzer

AccessContextFuzzer is a Burp Suite extension built on the Montoya API, designed to automate access control testing that would otherwise require tedious manual configuration. Three independent fuzzing engines cover HTTP header manipulation, URL path bypass, and selection-targeted fuzzing — all under a single, unified interface.

Installation

Requirements: Burp Suite 2023.1+ and Java 17+

Download the latest JAR from the GitHub Releases page, then in Burp Suite go to Extensions → Add and select the file. The extension loads automatically and an AccessContextFuzzer tab appears in the toolbar.

Context Menu Integration

Right-click any request in the Proxy or Site Map and select "Send to AccessContextFuzzer" to load it directly into the correct engine tab.

Three Fuzzing Engines

1. Header Bypass

Tests IP spoofing and host manipulation across 40+ header variants including X-Forwarded-For, X-Real-IP, and X-Originating-IP. Targets systems that enforce trusted-IP checks or internal-network access controls.

2. Path/GET Bypass

Applies URL encoding, double encoding, IIS Unicode normalization, case flipping, dot-segment injection, and WCD-specific path techniques. Effective against WAFs and reverse proxies that implement rule-based access control.

3. Selection Fuzz

Focuses fuzzing on a specific text selection within a request, applying various encoding transformations. Supports loading custom wordlists from file for fully customized fuzzing campaigns.

Web Cache Deception Pipeline

Web Cache Deception (WCD) is a class of vulnerability where authenticated pages are cached and served to unauthenticated users, leaking sensitive data. AccessContextFuzzer automates the full attack chain in four phases:

• Delimiter Discovery — Identifies which path delimiters (;, ?, #, etc.) the server recognizes.
• Extension Testing — Combines discovered delimiters with static extensions (.js, .css, .png) to trigger caching behavior.
• Normalization Discrepancy — Detects path normalization differences between the origin server and the cache layer.
• Exploit Generation — Synthesizes all findings into a working WCD payload.

Smart Results Analysis

Results are displayed in a color-coded table with automatic anomaly detection — potential bypasses are highlighted in gold:

• STATUS_CHANGE — Unexpected HTTP status code deviation from the baseline
• BODY_DIFF — Content difference detected via MD5 hash comparison
• POTENTIAL BYPASS — Combined indicator of a likely access control bypass

Additional reliability features:

• Automatic baseline re-verification every 50 requests (session drift detection)
• Real-time fuzzing duration estimate via RTT averaging
• Adaptive rate-limit protection with increasing delays on 429/503 responses

Request/Response Viewer

Double-click any result row to open Burp's native HTTP editor with the full request/response pair. Supports Raw, Pretty, Hex, and Render tabs for complete inspection.

OPSEC Verification

A built-in OPSEC verification module confirms your external IP address before testing begins, preventing accidental exposure of your real IP to the target system.

Lab-Proven Effectiveness

AccessContextFuzzer successfully solves official PortSwigger Web Security Academy labs targeting:

• URL rewrite bypass scenarios
• Host header authentication bypasses
• Web Cache Deception exploitation

GitHub