ReproCase

HTTP 200 is not proof of an IDOR. ReproCase checks whether the boundary was actually crossed.

Download (Windows · macOS · Linux) · Docker · Burp extension · 56s demo · Case templates · Türkçe

_{Recorded from the real local app, no API key. Two accounts → Reproduced → write proof checked by the owner → export for the triager. ▶ Watch the 60s narrated video.}

The problem

You found an IDOR. Then the triager replies "could not reproduce": your cookies expired, the object ID belonged to yesterday's account, or the two "different" accounts turned out to be in the same tenant.

ReproCase turns the finding into a case: a small JSON file that anyone can run with their own accounts and newly created resources. On every run it checks three things:

Every run ends in exactly one verdict: reproduced, not_reproduced, or inconclusive. An expired session or a failed setup is reported as inconclusive, so it can never pass as a fix.

Who it is for

• Bug bounty hunters. Attach a case that proves itself and avoid "N/A, cannot reproduce".
• Triagers and program owners. Rerun a report with your own test accounts in seconds.
• AppSec teams. Keep the case as a regression check and rerun it after the fix.

Prove your own finding in four steps

Quick proof learns how your target works by watching it, so you never write JSON Pointers:

1. Accounts: enter the target origin and connect two test accounts you control. Sign in in a separate browser window, or paste a header, Bearer token or cookie from DevTools.
2. Identity: ReproCase calls common "who am I" endpoints (/me, /api/v1/profile, …) with both accounts and finds the account ID and organization fields by comparing the answers. If a guess is wrong, click the right field.
3. Requests: paste the request that creates the object and the vulnerable request that reads it by ID, straight from Burp or DevTools. Headers are ignored, so captured cookies are never stored.
4. Result: ReproCase creates one object as account A, finds the new ID, the owner field and a text field for the marker, detects CSRF if the creation is rejected, previews account B's access, deletes the object and saves the case. You review the policy, approve and run.

The verdict still comes from the normal run: a fresh object, a unique marker, verified accounts and the three outcomes. Quick proof also supports controlled write IDORs (PATCH/PUT/POST), role/function authorization and real-browser CORS private reads. The normal write flow still needs five inputs. See the new proof workflows (Türkçe).

Triagers: verify a report on your own site

Import the reporter's .reprocase.json. The Verify on my site dialog asks for your API origin and one credential per test account. If your identity endpoint or fields differ from the reporter's, ReproCase finds them and saves a new case revision, so there's no JSON to edit. The reporter's policy acknowledgement is reset: you read the claim and approve it yourself.

Try it in two minutes

Desktop app (Windows, macOS, Linux)

Download the newest file for your computer from Releases:

Then load the built-in local demo, approve and run (Reproduced). Choose Fresh identities and run again (still Reproduced), then switch to Secure target (Not reproduced).

The app bundles Electron and Chromium, so you do not need Node.js, Python or Docker. It is not code-signed yet, so check the archive before you run it (how to verify).

• macOS: because the app is unsigned, macOS blocks a normal double-click the first time. Right-click → Open → Open, or run xattr -dr com.apple.quarantine /Applications/ReproCase.app once.
• Linux: on Ubuntu 24.04 and newer, Electron apps need permission to use their sandbox. If ReproCase doesn't start, see Linux notes.

Docker (Linux, macOS, Windows)

git clone https://github.com/theasbug/reprocase.git
cd reprocase
docker compose up

Open the http://localhost:4317/#token=… URL from the logs. The container starts the built-in demo lab with headless Chromium, and data is kept in the reprocase-data volume. The port is published on 127.0.0.1 only. For your own targets, change the compose command to serve.

Run from source (Linux, macOS, Windows)

Requires Node.js 24.18+.

git clone https://github.com/theasbug/reprocase.git
cd reprocase
npm ci --ignore-scripts
npm run browsers:install
npm run demo

Open the local URL printed by the command. On Linux, first run npx playwright install-deps chromium. The web workbench and the case runner work on every platform. Native desktop control is Windows-only.

A case in 30 seconds

{
  "policy":        { "statement": "A private document is readable only by its owner." },
  "preconditions": [ { "op": "neq", "left": {"$ref": "actors.owner.tenant"}, "right": {"$ref": "actors.researcher.tenant"} } ],
  "steps": [
    { "id": "create-document", "actor": "owner",      "method": "POST", "path": "/documents", "body": { "marker": {"$ref": "run.marker"} } },
    { "id": "probe",           "actor": "researcher", "method": "GET",  "path": "/documents/{document}" }
  ],
  "witness": {
    "success":   [ { "op": "eq", "left": {"$ref": "steps.probe.body.marker"}, "right": {"$ref": "run.marker"} } ],
    "rejection": [ { "op": "in", "left": {"$ref": "steps.probe.status"},      "right": [403, 404] } ]
  }
}

_{Simplified. See the full executable example and the case format.}

Reuse a proven case. Save any case as a template, then open Templates → Use on a target, type another target you're allowed to test, map paths if its API differs, connect your own test accounts and run. Built-in templates from templates/ cover horizontal IDOR (read and write), vertical privilege escalation, role and CORS reads. Cross-tenant read and write cases are in examples/. Import a HAR, raw HTTP, Burp XML or Postman capture to draft a case from your own traffic.

From Burp Suite in one click

Install the ReproCase Burp extension, then right-click any request in Proxy history or Repeater and choose Send to ReproCase. The selection becomes a case draft. Nothing is sent to the target until you bind your accounts and run it.

From Arjun and ffuf: find the IDOR leads worth proving

Paste Arjun (-oJ) or ffuf (-of json) output into Import evidence. ReproCase ranks the results by identifier signals, such as order_id parameters, numeric or UUID path segments after /users/, and fuzzed IDs that returned 2xx. One click turns a lead into a case draft. Parsing is offline, and captured cookies or tokens are never copied.

npm run cli -- candidates arjun.json            # list ranked leads
npm run cli -- candidates ffuf.json --draft 1   # create a case draft from lead #1

What is inside

• Proof engine. Isolated Chromium account contexts, cookie or Bearer bindings, live preflight, JSON Pointer captures, read and controlled-write cases, actor matrices and run comparisons.
• Sharing. Sanitized .reprocase.json packages without credentials (recipients bind their own accounts), plus HTML/Markdown reports and Playwright proof exports.
• CLI and MCP. import, validate, run, compare and export commands and a stdio MCP server that use the same services as the UI. See the CLI docs.

AI assistant (bring your own model, off by default). Use it to investigate and draft cases. The verdict always comes from the deterministic checks above, never from the model. It supports OpenAI, Anthropic, Gemini, DeepSeek, OpenRouter, Groq, Mistral and compatible local endpoints, along with local file tools, terminal access, Windows desktop control and MCP servers. Tool actions ask for approval by default. Auto-edit and autonomous modes are explicit opt-ins. Provider details.

Bug bounty utilities. Program scope and exclusions, rate limits and request budgets, bounded CT/HTTP discovery, JWT/JS/traffic helpers, a CVSS v3.1 calculator and a finding tracker. Nuclei, subfinder, httpx, ffuf, nmap and sqlmap are detected when installed but not bundled.

Security model

• The local service binds to loopback only and requires authentication. Importing a capture never sends a request.
• Cases are declarative JSON. They contain no JavaScript or shell. Unknown fields are rejected.
• Credentials are kept out of cases and redacted from shared evidence. Saved desktop credentials use Windows OS encryption.
• Scope, exclusions, budgets and rate limits apply to every request that ReproCase itself sends. The optional AI terminal and desktop tools and external MCP servers are not sandboxed by that policy. Ctrl+Alt+Esc stops active agent work.

Never publish your ReproCase-data folder, sessions or private captures. See SECURITY.md and tested behavior and limitations.

Verify a download

Each release ships a SHA256SUMS.txt file:

Get-FileHash .\ReproCase-*-Windows-x64.zip -Algorithm SHA256

Releases built by the release workflow also carry a signed GitHub build-provenance attestation. It proves that the archive was built from this repository's source by GitHub Actions:

gh attestation verify ReproCase-<version>-Windows-x64.zip --repo theasbug/reprocase

Development

TypeScript · npm workspaces · Fastify · React/Vite · Zod · SQLite · Playwright · Electron.

npm run typecheck && npm test && npm run test:e2e

GitHub Actions tests the source on Linux and Windows and packages and smoke-tests the Windows and Linux apps on every change; releases also build and smoke-test both macOS apps. Desktop details are in docs/DESKTOP.md and release checks in docs/RELEASE-CHECKS.md.

About how it is built. ReproCase is developed with heavy use of AI coding assistants. Verdicts come from deterministic, tested core checks, and VERIFICATION.md separates what has been tested from what has not. Reviews and bug reports are especially welcome.

Documentation and community

• English guide · Türkçe kılavuz · Türkçe hızlı başlangıç
• Case format · Templates · CLI · Proof exports · Desktop · Changelog
• Why HTTP 200 is not proof · Five-minute beta test
• Contribute · Report a bug · Security reporting

The most useful contributions right now are new case templates for real-world IDOR patterns, minimal local reproductions, provider compatibility reports (without keys) and translations. If ReproCase saves you a "could not reproduce", a ⭐ helps other researchers find it.

License

Apache-2.0. Built on Playwright, Electron and the MCP TypeScript SDK. Hurl is a great tool for request replay. ReproCase focuses on preserving account and resource relationships and validating evidence when the accounts change.