AndroScanner: Automated Backend Vulnerability Detection for Android Applications
arXiv:2604.14431v1 [cs.CR] 15 Apr 2026
Harini Dandu [email protected] Master of Science in Cybersecurity Georgia Institute of Technology
Abstract—Nowadays, there exists a mobile application for every feature from ordering a coffee to monitoring bank accounts. Backends at these mobile applications provide various functionalities such as content delivery, analytics, ad networks, telemetry, and more for the daily maintenance of the apps. These functionalities are mainly delivered by the APIs. Unfortunately, application developers are unaware or have no control over the security practices when choosing or managing these services. The mobile applications using these backends are in turn installed by millions of users potentially affecting thousands of them. These exposed backend vulnerabilities can be used by attackers to compromise the mobile backend, which can result in leaking user data, deleting application content, or injecting malicious code. It is necessary to analyze these mobile apps’ backends and provide actionable remediation to the application developers. This paper presents AndroScanner, an automated pipeline for vetting the backends that mobile applications interact with and providing actionable remedies. We evaluate AndroScanner on two Android applications: a purposely vulnerable bank application and Hirect, a production recruitment application with over 50k downloads on Google Play Store. Across both applications, AndroScanner extracted 24 APIs (4 and 20 respectively), identified 5 total vulnerabilities (4 in the bank app and 1 in a recruitment app), and discovered a previously unreported Excessive Data Exposure vulnerability in the recruitment application ranked 3rd in the OWASP API Security Top 10. The tool is available upon request to assist app developers in improving the security of their mobile backends. KEYWORDS: Android Security, Mobile Application Security, API Vulnerability Detection, Static Analysis, Dynamic Analysis, Penetration Testing, OWASP API Security, APK Analysis, Excessive Data Exposure, Security Automation.
I. I NTRODUCTION More than 5.3 billion people use mobile applications [1]. Around 90 percent of individuals rely on smartphones. Roughly about 40 apps exist on each of these phones. Mobile backends provide various features such as content delivery, ad networks, telemetry, and more. These features are supported by several layers of software and multiple vendors including
cloud providers, hosting providers, and content delivery networks (CDNs) that offer managed platforms, operating systems, and physical/virtual hardware. The inherent complexity of these backends makes secure deployment and maintenance difficult. As a result, when selecting these infrastructures for creating or renting mobile backends, application developers frequently overlook the security standards. [2] Backend breaches of mobile applications which happened recently indicate how prevalent these attacks are. The Fortnite mobile game hijacking [3] demonstrated how progressively downloaded material from mobile backends can allow an attacker to install new mobile apps without the user’s knowledge. Even if the developer is security conscious, because of third-party libraries, it is unclear with which backends their mobile app will interface. Third-party libraries do not reveal their backends to developers; instead, they provide an application program interface (API) via which developers may interact. Many of these risks are avoidable if developers have the necessary tools and resources to assess the security of their backends. Furthermore, identifying insecure software layers and the responsible party helps speed up the remediation, lowering the risk of exposure. Unfortunately, existing solutions like Drozer [4] demand practical recommendations for mobile app developers. The latest study on server-
side vulnerability detection of mobile apps [7]– [9] also has revealed that app developers’ lack of security knowledge is a rising issue. However, by focusing solely on the software service layer of mobile backends, these studies merely scrape the surface. To identify the most significant difficulties impacting mobile backends, a thorough analysis of APIs is required. Furthermore, in order to carry out such a study, the analysis must be reproducible, transparent, and simple for developers to comprehend. The research should be conducted on a representative mobile app ecosystem in order to offer a clear picture of the backend vulnerability environment. Finally, the research should provide vulnerabilities to follow in order to assist and inform them about the security of their mobile backends. To the end, this paper presents the design and implementation of AndroScanner, an automated analysis pipeline to study mobile backends. Using AndroScanner, I have tested two applications, Bank App which is a vulnerable application [5], and the Hirect application [6] which has over 50k+ downloads on Google Playstore. AndroScanner retrieves a list of backend APIs from an input APK, using remote vetting techniques to discover software vulnerabilities and accountable parties, and offers a list of existing vulnerabilities to the app developer. Findings discuss the total number of vulnerabilities present in each of these applications considering different scenarios. II. D ESIGN The design for AndroScanner can be broken down into three major parts. They are as follows: 1) Extracting API calls using Static Analysis and Dynamic Analysis. 2) Vetting the extracted APIs for vulnerabilities. 3) Reporting the list of vulnerabilities to the target user.
Figure 1 depicts the whole design of the system. Let’s deep dive into each of the implementation steps. III. E XTRACTING THE API C ALLS The first step of the automated pipeline AndroScanner is extracting the API calls that are involved in the backend application. As static analysis alone would not be possible to extract the APIs, I have considered both static and dynamic analysis approach. Let’s discuss how each of these approaches is implemented. The input for the pipeline as well as this step is an APK file of android applications. In the static analysis, I have used two tools namely apktool [10] and androguard [11]. In the dynamic analysis, I have mainly used the Frida instrumentation plugin. A. Static Analysis For a given application to be tested, the source code is not available apart from its APK file. As input, an APK file is provided. An APK (Android Package Kit) is the file format for applications used on the Android operating system. APK files are compiled with Android Studio, which is the official integrated development environment (IDE) for building Android software. An APK file includes all of the software program’s code and assets. As the APK file is in compressed ZIP format, the ZIP decompression tool can open it, the best one in the market is the apktool. 1) apktool: apktool is used for reverse engineering 3rd party, closed, binary Android apps. It can decode resources to their nearly original form and rebuild them after making some modifications. It also makes working with an app easier because of the project like file structure and automation of some repetitive tasks like building apk, etc. It is not intended for piracy and other non-legal uses. It could be used for localizing, adding some features or support for custom platforms, analyzing applications, and much more.
Fig. 1: Workflow of AndroScanner Some of its features include Disassembling resources to their nearly original form (including resources.arsc, classes.dex, and XMLs), rebuilding decoded resources back to binary APK/JAR, organizing and handling APKs that depend on framework resources, smali debugging (removed in 2.1.0 in favor of IdeaSmali), helping with repetitive tasks. Details on how to install the application are mentioned here: https://ibotpeaches.github.io/Apktool/install/ apktool is used here in the AndroScanner to decompress the APK file and read the permissions in the Manifest file. Android manifest file helps to declare the permissions that an app must have to access data from other apps. It also specifies the app’s package name which helps the Android SDK while building the app. Every app project must have an AndroidManifest.xml file (with precisely that name) at the root of the project source set. To detail, the components added to the manifest file, • The
components of the app, includes all activities, services, broadcast receivers, and content providers. Each component must define basic properties such as the name of its Kotlin or Java class. It can also declare capabilities such as which device configurations it can handle, and intent filters that describe how the component can be started. • The permissions that the app needs in order to access protected parts of the system or other apps. It also declares any permissions that other apps must have if they want to
access content from this app. • The hardware and software features the app requires, which affects which devices can install the app from Google Play. Using the manifest file, the permissions to the file are read to get a better idea of app functions to be focused on. Our focus is primarily on the API calls, in order to perform API calls at the server level, an API key is used. 2) APIKey Extractor: An API key is a code used to identify and authenticate an application or user. API keys are available through platforms, such as a white-labeled internal marketplace. They also act as unique identifiers and provide a secret token for authentication purposes. APIs are interfaces that help build software and define how pieces of software interact with each other. They control requests made between programs, how those requests are made, and the data formats used. They are commonly used on Internet-of-Things (IoT) applications and websites to gather and process data or enable users to input information. For example, users can get a Google API key or YouTube API keys, which are accessible through an API key generator. An API key is passed by an application, which then calls the API to identify the user, developer, or program attempting to access a website. It can help break development silos and will typically be accompanied by a set of access rights that belong to the API the key is associated with.
An existing tool named APIKey Extractor mentioned in the call can be extracted using [12] is used in the AndroScanner workflow dynamic analysis only. to extract the API key. It searches for API For reference Figure 2 depicts the whole prokeys embedded in Android String Resources, cess involved in extracting the APIs and their Manifest metadata, Java code (including parameters. Gradle’s BuildConfig), and Native code. Further installation and usage details are provided at B. Dynamic Analysis github.com/alessandrodd/apk api key extractor. In the dynamic analysis phase, AndroScanner The permissions extracted from the manifest uses a dynamic instrumentation toolkit Frida. file using the apktool and the API key extracted It can be used by developers, reverse engineers, using APIKey Extractor are sent to the next and security researchers. It can incorporate cusstep for dynamic instrumentation. In the dy- tom scripts into black box process [17]. No namic analysis, these functions are prioritized source code is required to hook any function, and studied initially. Once the analysis of these spy on encryption APIs, or track secret applicafunctions is done, the Frida [13] instrumentation tion code. The scripts can be edited, saved, and looked into the results right away. All of them plugin will be used. 3) Androguard: Another tool I have used can be done, without the need for compilation in the static analysis phase is Androguard. or application restarts. Frida is compatible with Windows, macOS, It is primarily a Python tool to experiment with android application APK files, disassem- GNU/Linux, iOS, watchOS, tvOS, Android, bling and decompiling Dex files (.dex - Dalvik FreeBSD, and QNX. Moreover, Frida is openvirtual machine code), Android’s binary xml source software. Python and Javascript are re(.xml) Android Resources (.arsc). And the tool quired to access it. Python is used to communiis available for Linux/OSX/Windows (python cate with the application device, and Javascript is used to hook into the desired functions. powered). In order to experiment with Frida, an android Using androguard, you can build a control flow graph and call graph using the CLI support. emulator is setup and Frida server script is The call graph is constructed from the Analysis run inside the android emulator (client) and object and then converted into a networkx Mul- javascript script to hook into the interested tiDiGraph. Methods are nodes in the produced function calls is run on the server, in our case network, while calls are edges. The offset inside it is Ubuntu Linux OS. Adb tools [14] are used to connect to the the method is kept as a property on each edge, and repeated calls between two methods result android emulator/physical device. It is a powerful command-line tool for communicating with in several edges. The generated graphs will be enormous and devices. The adb command simplifies device give the details of all the application calls, tasks such as app installation and debugging. Frida-trace is used to hook into the funcboth internal and external. Each node has an attribute to indicate if it is an internal (defined tions of interest. Functions of interest are a somewhere in the DEXs) or external (might be curated list of API calls from the Android an API, but definitely not defined in the DEXs) Framework API Calls which act as Network method. The calls can be filtered further using Connection calls. These calls act as entry points for the Frida-trace. Over 200 calls are colcustomized scripts. As the generated graphs are huge and require lected. For example HttpParam, HttpConnecfurther filtering, they only provide the details of tionParams, HttpCookie, etc. Some of the exthe calls but not the parameters. The parameters tracted API calls are mentioned in Table I While
Fig. 2: Extracting API Calls in AndroScanner running Frida trace, using Javascript, Frida can be hooked into these entry points. The parameters used in the API calls are also extracted. An example of a frida hook using Javascript can be seen in Fig 3 Once the API Calls are extracted, they are categorized into internal and external calls. External calls are defined as the API services obtained from the 3rd party services like Amazon, Firebase, Apache, etc. Internal calls are defined as all the calls apart from external calls. External APIs are a curated list obtained from scanning the top 5,000 android applications from Google Playstore using LibScout [15]. Over 50 of them are collected [16], they are specified in the table II. Using the curated list as a reference, if the extracted API contains the external library as a source that means if the API call domains contain the external library name, then it is considered as the external API Call.
By generating these categorizations of internal and external calls, the target user can focus on fixing the vulnerabilities in the internal calls, whereas risks corresponding to the external calls are to be reported to the appropriate 3rd party owner. IV. V ETTING THE API S In order to vet for the vulnerabilities in the extracted APIs, the focus is on OWASP’s Top 10 API Security Vulnerabilities [19]. An existing tool, APIFuzzer [18] is used to analyze the API calls extracted from the previous step ’Extraction of API Calls’. APIFuzzer is a pip installable package. The tool’s main features include parsing API definition from local files; JSON file input format support; all HTTP methods are supported for testing; fuzzing of request body, query string, path parameter, and request header are supported. APIFuzzer reads the API definition from a remote URL or local JSON file as the input. Once
Android Framework API Entry Points HttpParams HttpConnectionParams HttpAuthHandler ContentHandlerFactory CookiePolicy CookieStore DatagramSocketImplFactory HttpRetryException Network NetworkCapabilities NetworkInfo NetworkRequest
HttpCookie HttpURLConnection CacheRequest CacheResponse ContentHandler URL URLClassLoader URLConnection URLDecoder URLEncoder URLStreamHandler Authenticator
TABLE I: List of Android Framework API Entry Points
Fig. 3: An example of frida hook in Javascript it analyzes, it outputs a pdf report containing the VI. E XPERIMENT details of vulnerabilities present in a URL. The In order to test the functionality of the Anpdf document is reported to the user. droscanner pipeline, I have taken two android applications into consideration. One is a Vulnerable Bank application and the other is currently V. R EPORTING THE V ULNERABILITIES used Google Playstore application ’Hirect’. The pdf document containing the vulnerability details given an API URL is presented to the user as an output. As an addition, after the analysis is completed, the vulnerabilities may be disclosed to the user directly by email. This way, instead of returning to examine the generated reports frequently, the user may begin the analysis process and continue with their other duties.
A. Bank Application A vulnerable bank application apk is given as input to the AndroScanner pipeline. The app does basic functionalities such as transferring a certain amount to another account, viewing account statements, and changing passwords for the logged-in user. Let’s dive into one of the APIs, change password, and the vulnerabilities explored.
External APIs heyZap ironSource jsoup roboguice scribe smaato ACRA AMoAd Amazon Segment Apache WeChat flickrj vkontakte AppBrain AppFlood AppsFlyer BeaconsInSpace
Fyber Google Gson Guava Guice HockeyApp InMobi JSch Joda-Time Pollfish Millennial Media Mixpanel MoPub New-Relic OkHttp Parse Paypal Picasso
Stetho Supersonic Syrup Tapjoy Tremor Video Twitter4J Urban-Airship Vungle WeChat AppFlood heyZap ironSource jsoup roboguice scribe smaato vkontakte
Bolts Brightroll Butter-Knife Chartboost CleverTap Crashlytics Crittercism Dagger EventBus ExoPlayer Facebook Firebase Flurry AdColony AdFalcon Adrally Fresco
TABLE II: List of External APIs extracted from LibScout Although androguard from the static analysis did not provide any useful information, after the function hook in the dynamic analysis, frida prints out the function and its parameters corresponding to the call. After formatting, the generated parameters can be seen in the Figure 4. Once the API and its parameters are obtained, json format of the API is passed to the APIFuzzer. It then reports the vulnerabilities in the given API call which can be seen in Figure 5 It reports that the HTTP X-XSS-Protection response header is missing which is the most basic header that prevents cross-site scripting. VII. R ESULTS After running both the applications into the AndroScanner, a list of vulnerabilities obtained can be compared in Figure 6 All the APIs that could be extracted from the Bank and Recruitment application are 4 and 20
respectively. Out of which, the external APIs obtained using Table II is 1 and 4 respectively. The other 3 and 16 APIs are internal APIs. The vulnerabilities exposed in the Bank and Recruitment applications are 4 and 1 respectively. The domains for the extracted APIs for the Bank and Recruitment app are mentioned in the Table III Hirect is an android application that focuses on employment-oriented online service that operates via websites and mobile apps. The vulnerability found in the seekermsg endpoint is Excessive Data Exposure, which is ranked 3rd among the OWASP API Security Vulnerabilities. It discloses the timestamps of messages sent to users. An attacker can access this timestamp to generate a custom message pretending to be a recruiter and exploit the job seeker. This vulnerability was responsibly disclosed to the Hirect development team prior to publication of this paper. Further technical details are withheld
Fig. 4: Extracting changepassword API Call in Bank Application
Fig. 5: Reported Vulnerability by APIFuzzer for changepassword pending remediation. Although I have found one vulnerability in the recruitment application, I expected it to be zero as it is one of the popular apps used in today’s applications. This motivates me to scan the other top android applications from PlayStore as part of my future work. Challenges Covered: One of the challenges faced in any of the tools nowadays is customized functions that are built by the application developers to perform the network connection calls. The present pipeline only detects the functions included in the curated Android Framework entry points list. This can be solved by an extension that takes in customized javascript functions as Frida hooks to analyze. All the scripts under a ’customize’ folder are provided as function hooks during dynamic
analyses. I have also contacted an Android Developer Sonu Saurab who works at ShareChat to review the AndroScanner. He has mentioned that the application could extract 80 percent of the API calls as far as the scope taken. However, he could not understand the reported vulnerabilities from the pipeline and the actions to be performed. He mentioned that GUI support for the tool could help him better comprehend the vulnerabilities and patch them. He also sought an IOS-compatible tool. VIII. TARGET U SERS The target users for the project are the app developers working on the application backends, researchers, or analysts working in the android application Pen-testing area. The pipeline
Fig. 6: Comparison of Extracted APIs for Bank and Recruitment Applications API
Bank App
Recruitment App settings.crashlytics.com e.crashlytics.com api.wechat.com bcdn.wechat.com
external
fonts.gstatic.com
vulnerable
insecurebankv2.ChangePassword insecurebankv2.PostLogin insecurebankv2.DoTransfer insecurebankv2.ViewStatement
seekermsg.hirectapp.com
TABLE III: External and Vulnerable APIs recorded in the Bank and Recruitment App serves as black-box testing in the pre-production IX. L IMITATIONS & D EPLOYMENT phase. A. Limitations
The pipeline Androscanner can also be used as Platform-as-a-Service (PaaS) to test the mobile applications at scale. However, the current pipeline requires some tweaks such as increased CPU performance, to undertake testing at large volume.
1) Android only compatible: The current pipeline Androscanner is compatible only with android APK files and these files must be JAVA based. Hence, It does not support IOS applications. 2) Encrypted Parameters: Frida hooks into the function calls and extracts the API call parameters. If these parameters are encrypted
using the customized encryption function, there is no way for the AndroScanner pipeline to detect these parameters automatically. As the encryption function is not included in the entry points functions to hook, the scanner would not detect it and extracted parameters would be still encrypted. 3) CLI Support: As discussed in the implementation section, the pipeline is accessible using the Linux Command Line Interface support. The process of interacting with tools is automated using bash scripts.
XI. F UTURE S COPE The following extensions can be considered as part of the future work to develop the pipeline. A. Confidence score
Currently, Androscanner only uses APIFuzzer to extract vulnerabilities, given an API URL. Instead of relying on one tool, multiple tools can be used to extract vulnerabilities. For a given URL, the extracted vulnerabilities corresponding to single technology can be bundled up and a confidence score can be computed. The confidence score of a vulnerability indicates the B. Deployment Androscanner pipeline is hosted on Linux Op- confidence or likelihood that the vulnerability erating System (Ubuntu 22.04). Major softwares is affecting the target URL for an application. Thus, the confidence score gives an extra layer installed are as follows: of understanding the vulnerabilities present in • Python the application. • Java • apktool B. Vulnerability Ranking • APIKey Extractor In the given project, the target users are • Androguard mainly app developers. The output of the third • Android Emulator step of the Androscanner lists the vulnerabilities • Adb tools existing in a URL. The problem here is, as • Frida the app developer is not security-focused, they • Javascript would not understand which of these listed • APIFuzzer vulnerabilities are important. They cannot priX. C ONCLUSION oritize the risks. Hence, using an existing vulAndroScanner, an analytical pipeline for nerability database such as ExploitDB can be studying mobile app backends, was introduced used to rank the vulnerabilities. They can be in this paper. I have analysed empirically two categorized as ’High’, ’Medium’, and ’Low’ of the applications, one is a Vulnerable Bank severity. This gives the developer a clear picture Application and the other is a production re- of risks. cruitment application with over 50k+ downloads on Google Playstore. The vulnerable Bank C. Patch Suggester Vulnerability ranking functionality can be exApplication is used to test the pipeline and finetune it. It has discovered a zero-day vulner- tended to provide a patch suggester to fix the ability in the recruitment application. Finally, vulnerabilities listed. Existing patch suggesters AndroScanner is available upon request to assist developed by Syxsense [20] which is the best app developers in improving the security of in the market can be used. However, it is not their backends, providing insight into which an open-source tool. Anyway, building a patch platforms are susceptible, and guiding devel- suggester from scratch has its own challenges. opers in resolving vulnerabilities discovered in One of the solutions would be developing using machine learning models. their backends.
D. Automatic Reporting Considering the current Androscanner pipeline, the list of vulnerabilities is reported as a pdf to the target user. If multiple applications are being tested at a go corresponding to different owners, the reporting is difficult. Hence, a backend functionality that stores the owners’ details like email, and phone number in the database (MySQL) and reports the vulnerabilities automatically to the owner is needed. It can be built using Python and MySQL. E. Docker Container The present pipeline is deployed on a Ubuntu Linux Operating System with a number of required software packages installed for running the tools. An app developer may have to use distinct versions of the same software for various projects. To solve this problem, docker containers can be used. Docker streamlines the development lifecycle by allowing developers to work in standardized environments using local containers which provide your applications and services. Containers are great for continuous integration and continuous delivery (CI/CD) workflows. F. GUI Support As discussed previously regarding the feedback from the Android Developer, one of the requirements mentioned is GUI support. This would allow the app developer to easily navigate through the tools and use them effectively without worrying about the contents of the tools. ACKNOWLEDGMENT The author would like to thank Prof. Mustaque Ahamad of the Georgia Institute of Technology for his guidance and support throughout this work. This work was originally completed in December 2022 and is being made publicly available here.
R EFERENCES [1] S. O’Dea, “Number of smartphone users worldwide from 2016 to 2022,” Statista, Jun. 2022. [Online]. Available: https : / / www . cybertalk.org/2022/06/10/10- eye- openingmobile-malware-statistics-to-know/ [2] Alpha Software, “Security and Back-End Integration: Top Mobile Challenges,” Alpha Software Blog, 2021. [Online]. Available: https://www.alphasoftware.com/blog/ security - and - back - end - integration - top mobile-challenges-says-survey [3] A. Martonik, “Epic’s first Fortnite Installer allowed hackers to download and install anything on your Android phone silently,” Android Central, Aug. 2018. [Online]. Available: https : / / www . androidcentral . com / epic- games- first- fortnite- installer- allowedhackers-download-install-silently [4] WithSecure Labs, “Drozer: Android Security Assessment Framework,” GitHub, 2022. [Online]. Available: https : / / github . com / WithSecureLabs/drozer [5] D. Shetty, “Android-InsecureBankv2: Vulnerable Android Application for Security Testing,” GitHub, 2020. [Online]. Available: https : / / github . com / dineshshetty / Android InsecureBankv2 [6] Hirect, “Hirect: Direct Chat & Job Search App,” Google Play Store, 2022. [Online]. Available: https://play.google.com/store/apps/ details?id=in.hirect [7] K. Watkins and S. M. Kywe, “Unsecured Firebase Databases: Exposing Sensitive Data via Thousands of Mobile Apps,” Appthority, Tech. Rep., 2018. [8] C. Zuo, Q. Zhao, and Z. Lin, “Authscope: Towards Automatic Discovery of Vulnerable Authorizations in Online Services,” in Proc. 24th ACM Conf. Computer and Communications Security (CCS), Dallas, TX, Oct. 2017. [9] C. Zuo, Z. Lin, and Y. Zhang, “Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile Apps,” in Proc. 40th IEEE Symp. Security and Privacy (Oakland), San Francisco, CA, May 2019.
[10] C. Brubaker, “Apktool: A Tool for Reverse Engineering Android APK Files,” GitHub, 2022. [Online]. Available: https : / / ibotpeaches.github.io/Apktool/ [11] A. Desnos and G. Gueguen, “Androguard: Reverse Engineering, Malware and Goodware Analysis of Android Applications,” GitHub, 2022. [Online]. Available: https : / / github.com/androguard/androguard [12] A. D’Angelo, “APK API Key Extractor: Tool to Extract API Keys Embedded in Android Applications,” GitHub, 2019. [Online]. Available: https://github.com/alessandrodd/apk api key extractor [13] O. Ahl, “Frida: Dynamic Instrumentation Toolkit for Developers, Reverse-Engineers, and Security Researchers,” 2022. [Online]. Available: https://frida.re/ [14] Android Developers, “Android Debug Bridge (adb),” Android Developer Documentation, Google, 2022. [Online]. Available: https : / / developer.android.com/studio/command-line/ adb [15] M. Backes, S. Bugiel, and E. Derr, “Reliable Third-Party Library Detection in Android and its Security Applications,” in Proc. ACM SIGSAC Conf. Computer and Communications Security, Vienna, Austria, 2016. [Online]. Available: https://github.com/reddr/ LibScout [16] O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose, “SoK: Security Evaluation of Home-Based IoT Deployments,” in Proc. 40th IEEE Symp. Security and Privacy (Oakland), San Francisco, CA, May 2019. [Online]. Available: https : / / www. usenix . org / system/files/sec19-alrawi 0.pdf [17] Imperva, “Black Box Testing,” Imperva Learning Center, 2022. [Online]. Available: https://www.imperva.com/learn/applicationsecurity/black-box-testing/ [18] P. Kiss, “APIFuzzer: Fuzz Your Application Using its Swagger/OpenAPI Definition,” GitHub, 2022. [Online]. Available: https : / / github.com/KissPeter/APIFuzzer [19] OWASP Foundation, “OWASP API Security Top 10,” OWASP, 2019. [Online]. Available: https://owasp.org/www-project-api-security/
[20] Syxsense, “Syxsense Patch Management Solution,” 2022. [Online]. Available: https : / / www.syxsense.com/