AccessLens

Replay requests across identities. Find broken access control faster.

AccessLens is a Burp Suite extension for focused broken-access-control testing. It gives you a native-feeling workspace for replaying one request through multiple authorization profiles, comparing every result side by side, and investigating meaningful differences without leaving Burp.

Features

Burp-native workflow

• Repeater-style test tabs with add, close, and double-click rename interactions
• Native Montoya request and response editors for the original request and every profile
• Send to AccessLens context menu with a destination-tab picker and a New tab option
• Collapsible per-tab settings drawer that remembers its previous width
• Selected Original, profile, or Diff view stays active while moving between captured requests

Authorization profiles

• Any number of named profiles, each enabled directly from its tab
• Ordered mutation rules with independent enable/disable controls
• Add, replace, or remove values in:
  • Entire requests
  • Raw headers
  • Individual headers
  • Cookies
  • Query parameters
  • Form parameters
  • JSON values
  • Raw bodies
• Built-in Anonymous profile that removes the Authorization and Cookie headers

Capture and replay

• Optional Auto Send mode for matching Proxy traffic
• Burp Suite target scope is always enforced for automatic replay
• Per-tab host, path, and query regular-expression scope
• Filters for file extensions, methods, status codes, paths, and query parameters
• Duplicate suppression based on the request endpoint and body
• Bounded background execution so network work never blocks Burp's UI thread

Results and comparison

• One native-style table row per original request
• One result column per authorization profile
• HTTP status and exact response-body length for the original and every profile
• Color-coded SAME, SIMILAR, DIFF, ERROR, and PENDING classifications
• Method, result, status, and free-text table filters
• Configurable similarity threshold
• Run selected, run all, and clear-table actions in the table context menu

Focused Diff view

• Right-aligned Diff control, separate from the normal profile tabs
• Select any profile and compare both its request and response with the original
• Compare by lines, words, Unicode characters, or exact raw bytes in hexadecimal
• Clean colored unified diffs with word wrapping
• Oversized lines preserve both ends and report the exact hidden UTF-8 byte count

Project persistence

Test tabs, names, scopes, filters, profiles, mutations, Auto Send state, and comparison settings are stored in Burp project extension data.

Install

Download a release

Download burp-accesslens.jar from the latest GitHub release.

In Burp Suite:

1. Open Extensions → Installed.
2. Click Add.
3. Select Java as the extension type.
4. Choose burp-accesslens.jar.

Build from source

Requirements:

• JDK 21
• A Burp Suite release compatible with Montoya API 2026.7

./gradlew clean build verifyShadowJar --no-daemon

The verified extension is written to:

output/burp-accesslens.jar

The fat JAR includes AccessLens's runtime dependencies but excludes Montoya API classes because Burp provides them at runtime.

Quick start

1. Add the target to Burp Suite's target scope.
2. Right-click one or more HTTP messages and choose Send to AccessLens.
3. Select an existing AccessLens test tab or create a new one.
4. Create authorization profiles and configure their ordered request mutations.
5. Right-click the results table and choose Run selected, or enable Auto Send for matching in-scope Proxy traffic.
6. Review the profile columns, native request/response editors, and colored Diff view.

Safety

Use AccessLens only against systems you are authorized to test.

Auto Send is disabled by default, accepts only Proxy responses, and has a non-configurable Burp scope boundary. Manual replay remains an explicit user action.

Profile values are stored in Burp project data and may contain cookies, bearer tokens, or other credentials. Treat Burp project files as sensitive.

Development

Run the complete verification suite:

./gradlew clean build verifyShadowJar --no-daemon

The test suite covers response classification, unified diff generation, every mutation target/action combination, profile defaults, and key Swing interaction behavior. Pushes to main run the same verified build and publish the versioned JAR through GitHub Actions.

License

AccessLens is available under the MIT License.