authprobe

Authenticated-session record/refresh/export for DAST. Status: shipped.

The problem

DAST tools are good at crawling and bad at staying logged in. Session state lives in browser cookies, headers, CSRF tokens, and rotating refresh tokens — and every scanner re-implements capture, badly, in its own format. ZAP wants a context, nuclei wants headers, your own scripts want a cookie jar. One login, three formats, zero portability.

authprobe records one real login, detects expiry and replays the refresh path, and exports every format from that single source of truth. Sessions are credentials: they never leave the box.

Install

go install github.com/skeletonsec/authprobe/cmd/authprobe@latest

Demo

Links

• repo: github.com/skeletonsec/authprobe
• license: Apache-2.0
• design notes: land as posts in this section (first one is in draft)