Later archive addition

AUTHSCOPE: Towards Automatic Discovery of Vulnerable Access Control in Online Services

AUTHSCOPE drives mobile apps automatically, learns which fields of their authenticated API requests carry identity, then substitutes another user's identifiers or tokens and compares the responses to spot servers that hand back data belonging to someone else. It surfaces broken access control across online services at scale without server source code.

Record

Format

Whitepaper

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• idor
• auth-bypass
• rest-api
• android
• dynamic-analysis
• tooling
• info-leak
• large-scale-scan
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.