Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , |
|---|---|
| Format: | Preprint |
| Publié: |
2025
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866918139938209792 |
|---|---|
| author | Corradini, Davide Ceccato, Mariano Ghafari, Mohammad |
| author_facet | Corradini, Davide Ceccato, Mariano Ghafari, Mohammad |
| contents | We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that AuthREST is effective in improving web API security. Notably, it uncovered previously unknown authentication vulnerabilitiesin in four public APIs. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2509_10320 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST Corradini, Davide Ceccato, Mariano Ghafari, Mohammad Cryptography and Security Software Engineering We present AuthREST, an open-source security testing tool targeting broken authentication, one of the most prevalent API security risks in the wild. AuthREST automatically tests web APIs for credential stuffing, password brute forcing, and unchecked token authenticity. Empirical results show that AuthREST is effective in improving web API security. Notably, it uncovered previously unknown authentication vulnerabilitiesin in four public APIs. |
| title | Automated Testing of Broken Authentication Vulnerabilities in Web APIs with AuthREST |
| topic | Cryptography and Security Software Engineering |
| url | https://arxiv.org/abs/2509.10320 |