ZeroDOM

ZeroDOM

Point it at an app as two users. It finds the broken access control.

ZeroDOM drives your real, logged-in browser as two identities, replays the same requests as each, and flags where one user reaches what another can't — IDOR / broken access control, caught deterministically. Open-core, runs local, no account, no API key, nothing leaves your machine.

Under the hunt is a deterministic, token-lean perception engine for AI agents — the same core powers scan , crawl and any browser-driving task. IDOR is just where it bites hardest.

[Site](https://zerodom.vexralabs.com) · [Docs](https://zerodom.vexralabs.com/docs) · [Playground](https://zerodom.vexralabs.com/playground) · [Discord](https://discord.gg/tVRznUb5Ez) · [Quickstart ↓](#quickstart)

A normal user is denied the admin console (401) — then walks in by flipping one client-controlled cookie. ZeroDOM proves it: same request, two identities, 401 vs 200 . Full recording (mp4) .

---

Contents

• Why ZeroDOM
• Quickstart
• How it hunts — compare & sweep
• Use it from an AI agent (MCP)
• Why the agent sees so few tokens
• More of the CLI
• How it compares
• Install
• Security & scope
• Limitations
• Editions
• Contributing & development
• License

---

Why ZeroDOM

Two audiences, one engine:

• AppSec — [`compare` / `sweep`](#how-it-hunts--compare--sweep): deterministic two-identity authorization testing that runs headless in CI or your recon pipeline — no GUI, no account. scan --js adds DOM-XSS sinks, the callable API surface and header posture; repeat / probe / race turn recon into verification (Repeater, mass-assignment diff, and a TOCTOU burst).
• AI agents — [MCP](#use-it-from-an-ai-agent-mcp): a flat interaction graph that cuts ~71% of the tokens vs Playwright's aria_snapshot, with handles that resolve 1:1 and don't drift when the page re-renders.

Broken access control is the #1 web vulnerability (OWASP A01) and the one automated scanners miss — because catching it means knowing *who should be allowed to do what*, not just fuzzing one session. The usual answer is a human in Burp, clicking through the app as one user, then again as another, diffing by eye.

ZeroDOM does that mechanically. Give it two logged-in sessions; it replays the same request as each and reports the deterministic tells:

• `access-boundary-split` — one identity gets 200, the other 401/403 on an identical request. If the only difference between them is client-controllable (a cookie, header or param), that's broken access control.
• `cross-identity-identical-response` — two users get a byte-identical body on a per-user resource: a cross-tenant IDOR.

No LLM guessing, no "the AI thinks maybe." ZeroDOM surfaces the tell with the exact replay that proves it — a reviewable diff you drop straight into a bug report. You confirm the bug.

It drives your real Chrome (relay mode) over chrome.debugger, so your cookies, MFA and SSO are already done — or a throwaway browser (--stealth) if you'd rather not touch your session. Either way the page's markup never leaves your machine, and it's read-only by default: destructive actions and out-of-scope hosts are refused.

It works equally well as a one-line CLI, a recon pipeline stage, or a native tool an

AI agent drives through MCP. Same deterministic primitives, three front doors.

---

Quickstart

See it run in 10 seconds — no account, no browser download (bare zerodom is a static fetch, no Chromium needed):

pip install zerodom                      # or: uvx zerodom · npm i @vexralabs/zerodom

zerodom https://news.ycombinator.com # the interaction graph + a token report

That's the perception engine — a flat, 1:1-addressable graph instead of 12k tokens of HTML.

Now the flagship — find an IDOR. Save two logged-in sessions as Playwright storage_state files (one per account), then diff a protected endpoint across both:

zerodom compare https://app.example.com/api/admin/dashboard \

--as user=user.json --as admin=admin.json

{

"identities": { "user": { "status": 401, "bytes": 2616 }, "admin": { "status": 200, "bytes": 3469 } }, "only_admin": ["Manage users", "Billing & plans", "Overview"], "note": "admin authorized (200) where user denied (401) — broken access control if the only difference is client-controllable" }

That's the whole loop: same request, two identities, a 401-vs-200 split → a lead to confirm. only_admin lists the privileged controls the normal user should never see.

Don't have storage-state files? Capture one with context.storage_state(path="user.json") in Playwright, or export cookies from a logged-in session. Want the whole app, not one URL? → zerodom sweep.

---

How it hunts — compare & sweep

zerodom compare — one endpoint, across identities

Fetch one URL under each saved session and diff the responses. Byte-identical content across two users on a private resource is a cross-tenant IDOR; a 401-vs-200 split is a broken boundary. only_ lists the actionable nodes each identity sees that the other doesn't.

# Sweep a range of object ids through two identities:

seq 1 500 | sed 's#^#https://app.example.com/api/invoice/#' \ | zerodom compare - --as alice=alice.json --as bob=bob.json \ | jq 'select(.identical_body_pairs | length > 0)'

zerodom sweep — the whole app, one command

compare tests one URL. `sweep` does the entire app: it crawls as one identity to map the GET surface (pages + the API calls the JS fires), then replays every in-scope URL under *all* your identities and reports only the deterministic tells.

zerodom sweep https://app.example.com --as user=user.json --as admin=admin.json --format md

| severity | rule                   | url                                   |

| -------- | ---------------------- | ------------------------------------- | | medium | access-boundary-split | https://app.example.com/api/admin/... |

Read-only throughout: only GET is replayed, destructive URLs are dropped (--deny). --format md emits a report-ready table (default is JSONL). This is the "point it at an app with two logins and it finds the broken access control" pass.

Both take --proxy (route through Burp/Caido), --header (a program's WAF-bypass token), and a scope you can lock. Challenge pages (Cloudflare / Turnstile / reCAPTCHA / hCaptcha) are detected and climbed by a scope-gated clearance ladder; a wall nothing clears is reported as an honest blocked, never worked around outside an authorized target.

When recon finds a lead — repeat / probe / race

Mapping an app surfaces the endpoints; these verbs act on them. repeat is a Repeater over the session (--save writes HAR/.http evidence for a report). probe replays an endpoint with a tampered body and diffs it against the baseline — an accepted, reflected field is a mass-assignment lead. race fires a concurrent burst (one body, or a mix of operations via repeated --body) to flag a check-then-act race (TOCTOU); the stdlib engine is always available, and --engine http2 multiplexes the burst over one connection via the optional zerodom[race] extra.

zerodom race https://app.example.com/api/coupon --body '{"code":"SAVE20"}' -n 30 \

--setup setup.json --check https://app.example.com/api/cart

All three are exposed to agents over MCP as zerodom_repeat / zerodom_probe / zerodom_race.

---

Use it from an AI agent (MCP)

Standard MCP browser tools hand the model raw pixels (slow, stale on scroll) or an accessibility tree (no stable handles — repeated controls collide). zerodom-mcp gives your agent a flat, token-frugal graph where every click [45] resolves deterministically over CDP to exactly one element — and the same tools do cross-identity IDOR hunting the others can't. Why ↓

ZeroDOM is a native MCP server, so Claude, Cursor or any MCP agent can hunt with the same primitives. Run zerodom setup for a guided first-run (checks Chromium, prints the extension path + chrome://extensions steps, emits the config below, reports relay reachability — print-and-guide, no account, nothing leaves your machine).

// Claude Desktop: claude_desktop_config.json   ·   Cursor: .cursor/mcp.json

{ "mcpServers": { "zerodom": { "command": "uvx", "args": ["--from", "zerodom", "zerodom-mcp"] } } }

Once before first use (so the server never downloads mid-tool-call): uvx --from zerodom playwright install chromium.

Using LangGraph, CrewAI, OpenAI Agents SDK, Pydantic AI, LlamaIndex, Google ADK or AutoGen? Ready-to-run MCP examples — same server, a few lines each — are in examples/integrations/.

The full tool set (click to expand)

| `zerodom_set_viewport(wi