bac-analyzerlisted

# BAC Analyzer - Passive Traffic Analysis for IDOR/BAC Vulnerabilities ## Triggers - "analyze traffic" - "check for IDOR" - "BAC analysis" - "analyze HAR" - "analyze Caido" - "broken access control" - "IDOR scan" ## Description Passive traffic analyzer that examines captured HTTP traffic (HAR, Caido JSON, Burp XML) to identify potential Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) vulnerabilities. Generates test cases and reports. ## Input Formats - **HAR** - HTTP Archive format (browser DevTools, Caido export) - **Caido JSON** - Native Caido export format - **Burp XML** - Burp Suite proxy history export - **Caido API** - Direct pull from running Caido instance ## Installation ```bash # No external dependencies required - uses Python stdlib chmod +x ~/.openclaw/workspace/skills/bac-analyzer/scripts/*.sh chmod +x ~/.openclaw/workspace/skills/bac-analyzer/scripts/*.py # Optional: Add to PATH export PATH="$PATH:~/.openclaw/workspace/skills/bac-analyzer/scripts" ``` ## Usage ### Basic Analysis ```bash # Analyze HAR file ./analyze.sh traffic.har # Analyze Caido export ./analyze.sh caido-export.json # Analyze Burp XML ./analyze.sh burp-history.xml ``` ### Options ```bash # Generate HTML report ./analyze.sh traffic.har -o report.html # Tests only (no full report) ./analyze.sh traffic.har --tests-only # JSON output ./analyze.sh traffic.har --json -o results.json # Pull from Caido API (requires CAIDO_URL env var) ./analyze.sh --caido # Verbose