A Burp Suite extension (Montoya API) that follows a web application's authentication flow end to end and tells you what's actually happening: where every session cookie and token is issued, where it's subsequently used, what's inside the JWTs, how the pieces relate to each other, and where the flow deviates from expected practice.
Built for OAuth2/OIDC and JWT-based flows as well as classic server-side session authentication (ASP.NET Forms Auth and similar) — most existing JWT-focused Burp extensions only look at one token in isolation. This one correlates the whole flow: which cookie holds which credential, when it was issued, everywhere it's used, and how it relates to every other token in the capture.
Requires Burp Suite Professional. This extension reports findings into Burp's native Issues panel (a Scanner-adjacent API not present in Community Edition) and uses Burp's AI integration for the narrated summary — both Professional-tier features. It has not been tested against Community Edition and likely won't function fully there. See Requirements.
A note on the screenshots below: every screenshot in this README is an illustrative mockup built from synthetic, fictional data (
meridian-retail.example,northfield-wealth.example) — never a real captured target. They're there to show what each view looks like and does, not to reproduce a specific engagement.
Passive analysis, built from a live capture
- Recognises session cookies, auth credentials, JWT bearer/ID/refresh tokens, OAuth parameters (state, nonce, PKCE, authorization code), anti-forgery tokens, and classic framework session identifiers (ASP.NET, and others) — by value shape as much as by name, so it isn't fooled by an app that names its session cookie something unexpected.
- Maps every token's full lifecycle: where it was issued (if seen), everywhere it was subsequently used, and its lifetime/expiry.
- Decodes JWTs (structure only — header and claims, never attempting to forge or crack signatures) and flags decodable client-held data in other token types too.
- Produces graded findings (High/Medium/Low/Info) with tailored evidence, impact, and non-destructive verification steps — plus a separate "Controls Observed" section for things the app is doing correctly (PKCE with S256, proper cookie flags, CSRF protection present), so a report isn't only ever a list of problems.
- An AI-narrated summary (via Burp's own AI integration — no third-party API key required) that includes a per-host breakdown for multi-host flows, explicitly flagging trust-boundary questions like "this downstream API receives bearer tokens — verify it validates them independently."
Two explicit, confirmation-gated active checks
- Logout invalidation — replays a previously-captured authenticated request after logout, to check whether the session was actually invalidated server-side.
- Token substitution (token-type confusion) — substitutes an ID token in place of an access token on a real request, checking whether the backend is validating token type/audience/scope (RFC 9068, OWASP API2:2023) rather than just checking the signature is valid.
Both only ever replay data already captured from your own authorised session — nothing is derived, guessed, or sent anywhere without an explicit click and a confirmation dialog naming exactly what's about to happen.
Integrates with Burp itself, not just its own tab
- Findings can be sent into Burp's own native Issues panel (Dashboard / Site map),
with the source clearly identified in the issue title itself
(
Auth Flow Analyser - <finding>) — not just buried in the detail pane, the way most extensions leave it. - An "Auto-send to Burp Issues" option keeps that panel current across repeated analysis runs on a long engagement, with session-scoped deduplication so nothing gets sent twice.
Issues tab — graded findings, with the Controls Observed section for things the app gets right, not just what's wrong:
Token Timeline — a token's whole life at a glance: when it appeared, how long it stuck around, how often it was used, and whether it was actually seen being issued or just showed up already present:
Classic server-side session support — not just OAuth/JWT. Here recognising a classic ASP.NET Forms Authentication flow:
Multi-host awareness — the AI narrative names every host in the flow and flags the ones worth a closer look:
Placeholder-value detection — catching an app that mirrors a real credential into a cookie that started out holding a static default:
Native Burp Issues integration, with the source extension identifiable directly in the tree, not just after clicking in:
Active checks in action — logout invalidation:
—and token-type confusion:
The full toolbar — capture controls, the analysis tabs, and every action in one place:
From the BApp Store: not yet available — submission pending.
Manual build:
git clone https://github.com/zildac/Auth-Flow-Analyser.git
cd Auth-Flow-Analyser
./gradlew clean shadowJar
Requires JDK 21+. The built jar (build/libs/authflow-analyzer-<version>.jar)
bundles its own dependencies — load it via Burp's Extensions → Add → Java,
no separate downloads needed.
- Open the Auth Flow Analyser tab in Burp.
- Click Start capture, then drive the login flow you want to analyse through Burp (Proxy or Repeater) — log in, perform one authenticated action, log out if you want to test that too.
- Click Stop capture, then Analyze flow.
- Review the Token Flow, Issues, Tokens, Token Timeline, and Sequence Diagram tabs. Tick Show hidden to reveal tracking/noise tokens that were filtered out of the default view, with the reason each was filtered.
- Optionally click Explain with Burp AI for a narrated summary, or use the active checks (logout invalidation, token substitution) on a specific captured request — each requires an explicit confirmation before anything is sent.
- Send findings into Burp's own Issues panel with Send findings to Burp Issues, or tick Auto-send to Burp Issues to keep it current automatically as you re-run analysis through an engagement.
This extension is built for authorised penetration testing and security assessment work. The active checks (logout replay, token substitution) only ever replay requests and token values already captured from your own session during the current engagement — nothing is derived, brute-forced, or sent without an explicit confirmation naming exactly what will happen. Use only against targets you are authorised to test.
Persistence: findings sent to the Issues tab (and to Burp's own native Issues panel) are saved in your Burp project file and survive a restart, same as everything else Burp itself stores there — a Burp project is already expected to hold sensitive captured data as a normal part of using the tool. The other tabs (Token Flow, Tokens, Token Timeline, Sequence Diagram, Observations, AI Narrative) are intentionally session-scoped: they hold the current capture's full detail, including decoded token/cookie contents in unmasked form, and are cleared when Burp restarts rather than persisted a second time alongside the Issues tab's already-persisted summary.
- Burp Suite Professional — this extension reports findings into Burp's native Issues panel (a Scanner-adjacent API not present in Community Edition) and uses Burp's AI integration for the narrated summary, both Professional-tier features. It has not been tested against Community Edition and likely won't function fully there.
- Java 21 or later to build from source
Issues and pull requests welcome. If you hit a capture pattern the analyser misclassifies or misses, a sanitised (never a real client's) capture snippet reproducing it is the most useful thing you can include.
MIT — see LICENSE.