Mobile OAuth Tester

Package	Version	Identity Provider	Submission Time	Status
com.xxxxx.xxxx	3.4.2	wechat	2018-08-08 01:06:46	finished	Report
com.xxxxx.xxxxxxxxxx	6.2.4	wechat	2018-08-07 21:10:16	finished	Report
com.xxxxxxxxx.xxxxx	1.9.9	sina	2018-08-07 18:20:21	finished	Report
com.xxx.xxxxxxx	5.1.0	wechat	2018-08-07 16:30:27	finished	Report
com.xx.xxxxxx.camera	5.3.3	wechat	2018-08-07 13:40:51	finished	Report
com.xxxxxxxx.xxxxxxx	3.2.10	wechat	2018-08-07 12:33:42	finished	Report
com.xxxxxxxxx.xxxxxxxx	3.2.10	wechat	2018-08-07 11:10:49	finished	Report
com.xxxxxxxxxx.xxxxxxxxxx	3.2.3	sina	2018-08-07 09:19:14	finished	Report
xx.com.xxxxxx	2.1.5	fb	2018-06-29 12:13:22	finished	Report
xx.com.xxxxxxxxxxxxx.xxxxxxx	1.2.6	fb	2018-06-29 08:42:37	finished	Report
xx.com.app.xxxxxxxxxx	12.0	fb	2018-06-29 04:20:23	finished	Report

Potential Vulnerabilities 20

Category	URL	Parameter	Action	Severity
Credential Disclosure	http://x.xxxxxxxx.com/api/index.php	access_token	disclosure	high
App Secret Disclosure	api.weixin.qq.com/sns/oauth2/access_token	App Secret	disclosure	high
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxxxxx.xxx.xxxxxxxx.xx/v1/push/sdk/postlist	code	disclosure	low
Fail to Maintain the Code	http://x.xxxxxxxx.xxx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Fail to Maintain the Code	http://xx.xx.weibo.cn/entrance	code	disclosure	low
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low
Fail to Maintain the Code	http://xxx.xx.xxx.xx/api/index.php	code	disclosure	low
Access Token Substitution (Same RP)	api.weixin.qq.com/sns/userinfo	access_token	replace	medium
Others	x.xxxxxxxx.xxx/api/index.php	username	replace	unknown
Others	x.xxxxxxxx.xxx/api/index.php	username ,unionid	[u'rep', u'rep']	unknown
Others	sz.open.weixin.qq.com/connect/oauth2/authorize_reply	state	misused	unknown

Showing 1 to 20 of 20 entries

Potential Vulnerabilities 8

critical 2 high 1 medium 0 low 3

Category	URL	Parameter	Action	Severity
Profile Vulnerability	api.weixin.qq.com/sns/userinfo	unionid (in response)	replace	critical
Profile Vulnerability	api.weixin.qq.com/sns/userinfo	unionid (in response)	replace (value from toy app)	critical
App Secret Disclosure	api.weixin.qq.com/sns/oauth2/access_token	App Secret	disclosure	high
Fail to Maintain the Code	http://xxxxxx.xxxxx.com/client/api/getAppSwitch	code	disclosure	low
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low
Fail to Maintain the Code	http://dp.im.weibo.cn/entrance	code	disclosure	low
Others	sz.open.weixin.qq.com/connect/oauth2/authorize_reply	state	misused	unknown
Others	xxxx.xxxxx.com/login_api/thirdParty	sourceAccount	replace	unknown

Showing 1 to 8 of 8 entries

Potential Vulnerabilities 11

critical 6 high 1 medium 0 low 3

Category	URL	Parameter	Action	Severity
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize+	uid (in response)	replace (value from toy app)	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize+	uid (in response)	replace	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize++	uid (in response)	replace	critical
Profile Vulnerability	app.xxxxxxxxxxxx.com/user/create	openId	randomize	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize++	uid (in response)	randomize	critical
Profile Vulnerability	app.xxxxxxxxxxxx.com/user/create	openId	replace	critical
Credential Disclosure	http://app.xxxxxxxxxxxx.com/user/create	access_token	disclosure	high
Access Token Disclosure in sso_authorize	api.weibo.com/oauth2/sso_authorize+	access_token	replace (value from toy app)	low
Access Token Disclosure in sso_authorize	api.weibo.com/oauth2/sso_authorize+	access_token	replace	low
GSID replacement	api.weibo.cn/2/account/login+	gsid	replace	low
Others	app.xxxxxxxxxxxx.com/user/create	openId ,accessToken	[u'rep', u'rep']	unknown

Showing 1 to 11 of 11 entries

Potential Vulnerabilities 14

critical 5 high 1 medium 2 low 5

Category	URL	Parameter	Action	Severity
Profile Vulnerability	api.weixin.qq.com/sns/userinfo	unionid (in response)	randomize	critical
Profile Vulnerability	www.xxxxxxxx.com/account/login/wx	unionId	randomize	critical
Profile Vulnerability	www.xxxxxxxx.com/account/login/wx	unionId	replace	critical
Access Token Substitution (Other RPs)	api.weixin.qq.com/sns/userinfo	access_token	replace (value from toy app)	critical
Profile Vulnerability	api.weixin.qq.com/sns/userinfo	unionid (in response)	replace	critical
App Secret Disclosure	api.weixin.qq.com/sns/oauth2/access_token	App Secret	disclosure	high
Fail to Maintain the Code	http://www.xxxxxxxx.com/customer_center/customer_behavior	code	disclosure	low
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low
Fail to Maintain the Code	http://stats.xxxxx.cn/v2/report	code	disclosure	low
Fail to Maintain the Code	http://www.xxxxxxxx.com/customer_center/api_report	code	disclosure	low
Fail to Maintain the Code	http://dp.im.weibo.cn/entrance	code	disclosure	low
Access Token Substitution (Same RP)	api.weixin.qq.com/sns/userinfo	access_token	replace	medium
Access Token Substitution (Same RP)	api.weixin.qq.com/sns/oauth2/access_token	access_token (in response)	replace	medium
Others	sz.open.weixin.qq.com/connect/oauth2/authorize_reply	state	misused	unknown

Showing 1 to 14 of 14 entries

Potential Vulnerabilities 1

critical 0 high 0 medium 0 low 1

Category	URL	Parameter	Action	Severity
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low

Showing 1 to 1 of 1 entries

Potential Vulnerabilities 14

critical 6 high 2 medium 0 low 4

Category	URL	Parameter	Action	Severity
Profile Vulnerability	xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	openid	replace	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	replace	critical
Access Token Substitution (Other RPs)	api.weixin.qq.com/sns/oauth2/access_token	access_token (in response)	replace (value from toy app)	critical
Profile Vulnerability	xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	openid	randomize	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	replace (value from toy app)	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	randomize	critical
Credential Disclosure	http://xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	access_token	disclosure	high
App Secret Disclosure	api.weixin.qq.com/sns/oauth2/access_token	App Secret	disclosure	high
Fail to Maintain the Code	http://xxx.xxxxxxx.xxxxxxxxxx.com/v3/account/profile	code	disclosure	low
Fail to Maintain the Code	http://xxx.xxxxxxx.xxxxxxxxxx.com/v1/start	code	disclosure	low
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low
Fail to Maintain the Code	http://dns.map.baidu.com/remotedns	code	disclosure	low
Others	sz.open.weixin.qq.com/connect/oauth2/authorize_reply	state	misused	unknown
Others	api.weixin.qq.com/sns/oauth2/access_token	[u'text', u'openid', u'xxxxxxxxxx (in response)	replace (value from toy app)	unknown

Showing 1 to 14 of 14 entries

Potential Vulnerabilities 14

critical 6 high 2 medium 0 low 4

Category	URL	Parameter	Action	Severity
Profile Vulnerability	xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	openid	replace	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	remove	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	replace	critical
Profile Vulnerability	xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	openid	randomize	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	replace (value from toy app)	critical
Profile Vulnerability	api.weixin.qq.com/sns/oauth2/access_token	openid (in response)	randomize	critical
Credential Disclosure	http://xxx.xxxxxxx.xxxxxxxxxx.com/v1/third	access_token	disclosure	high
App Secret Disclosure	api.weixin.qq.com/sns/oauth2/access_token	App Secret	disclosure	high
Fail to Maintain the Code	http://xxx.xxxxxxx.xxxxxxxxxx.com/v3/account/profile	code	disclosure	low
Fail to Maintain the Code	http://dns.weixin.qq.com/cgi-bin/micromsg-bin/newgetdns	code	disclosure	low
Fail to Maintain the Code	http://xxx.xxxxxxx.xxxxxxxxxx.com/v1/start	code	disclosure	low
Fail to Maintain the Code	http://dns.map.baidu.com/remotedns	code	disclosure	low
Others	api.weixin.qq.com/sns/oauth2/access_token	[u'text', u'openid', u'xxxxxxxxxx (in response)	replace (value from toy app)	unknown
Others	open.weixin.qq.com/connect/oauth2/authorize_reply	state	misused	unknown

Showing 1 to 14 of 14 entries

Potential Vulnerabilities 12

critical 6 high 0 medium 0 low 5

Category	URL	Parameter	Action	Severity
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize+	uid (in response)	replace (value from toy app)	critical
Access Token Substitution (Other RPs)	api.weibo.com/oauth2/sso_authorize+	access_token (in response)	replace (value from toy app)	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize+	uid (in response)	replace	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize++	uid (in response)	replace	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize++	uid (in response)	randomize	critical
Profile Vulnerability	api.weibo.com/oauth2/sso_authorize+	uid (in response)	randomize	critical
Access Token Disclosure in sso_authorize	api.weibo.com/oauth2/sso_authorize+	access_token	replace	low
GSID replacement	api.weibo.cn/2/account/login	gsid	replace (value from toy app)	low
Access Token Disclosure in sso_authorize	api.weibo.com/oauth2/sso_authorize+	access_token	replace (value from toy app)	low
GSID replacement	api.weibo.cn/2/account/login	gsid	replace	low
Access Token Disclosure in sso_authorize	api.weibo.com/oauth2/sso_authorize	access_token	replace (value from toy app)	low
Others	api.weibo.com/oauth2/sso_authorize+	[u'text', u'uid', u'0000000000'] (in response)	replace (value from toy app)	unknown

Showing 1 to 12 of 12 entries

Potential Vulnerabilities 3

critical 2 high 0 medium 0 low 0

Category	URL	Parameter	Action	Severity
Profile Vulnerability	xxxxxxxxx.com/api/social-login	email	replace	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	email (in response)	replace	critical
Others		state	misused	unknown

Showing 1 to 3 of 3 entries

Potential Vulnerabilities 155

critical 14 high 0 medium 11 low 0

Category	URL	Parameter	Action	Severity
Profile Vulnerability	graph.facebook.com/v2.11/me	id (in response)	randomize	critical
Access Token Substitution (Other RPs)	graph.facebook.com/v2.11/me	access_token	replace (value from toy app)	critical
Profile Vulnerability	graph.facebook.com/v2.11/me	email (in response)	remove	critical
Access Token Substitution (Other RPs)	m.facebook.com/v2.11/dialog/oauth/read	access_token (in response)	replace (value from toy app)	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	email (in response)	replace	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	id (in response)	replace	critical
Profile Vulnerability	graph.facebook.com/v2.11/me	id (in response)	replace	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	email (in response)	randomize	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	id (in response)	randomize	critical
Profile Vulnerability	graph.facebook.com/v2.11/me	email (in response)	randomize	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	email (in response)	remove	critical
Profile Vulnerability	graph.facebook.com/v2.11/me	id (in response)	remove	critical
Profile Vulnerability	graph.facebook.com/v2.11/me+++	id (in response)	remove	critical
Profile Vulnerability	graph.facebook.com/v2.11/me	email (in response)	replace	critical
Access Token Substitution (Same RP)	m.facebook.com/v2.11/dialog/oauth/confirm	access_token (in response)	replace	medium
Access Token Substitution (Same RP)	m.facebook.com/v2.11/dialog/oauth/read	access_token (in response)	remove	medium
Access Token Substitution (Same RP)	m.facebook.com/v2.11/dialog/oauth/read	access_token (in response)	replace	medium
Access Token Substitution (Same RP)	m.facebook.com/v2.11/dialog/oauth/read	access_token (in response)	randomize	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me	access_token	randomize	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me	access_token	remove	medium
Access Token Substitution (Same RP)	m.facebook.com/v2.11/dialog/oauth/confirm	access_token (in response)	randomize	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me+++	access_token	remove	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me+++	access_token	randomize	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me+++	access_token	replace	medium
Access Token Substitution (Same RP)	graph.facebook.com/v2.11/me	access_token	replace	medium
Others	graph.facebook.com/v2.11/me+++	last_name (in response)	remove	unknown
Others	graph.facebook.com/v2.11/me+++	name (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	seen_scopes ,logger_id	replace (value from toy app)	unknown
Others	graph.facebook.com/v2.11/me+++	name (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'email', u'xxxxxxxx@hotmail.com'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,fb_dtsg	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	state (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,encoded_state	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me	last_name (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	name (in response)	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__ ,seen_scopes	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	Referer	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	datr	replace	unknown
Others	graph.facebook.com/v2.11/me	last_name (in response)	randomize	unknown
Others	graph.facebook.com/v2.11/me+++	last_name (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	logger_id	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fr	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	sb	randomize	unknown
Others	graph.facebook.com/v2.11/me+++	[u'text', u'last_name', u'Pat'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	encoded_state	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,__CONFIRM__	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	[u'text', u'access_token', u'EAAGj4gTtSA0BABThgpZCWBZA47RLZB4PY3lI61A6TweWcq1a7yRCIHofRQKO6ZBiRgZBPATjgwGA73ZAANlaUQXWkGP2J85HpldO1tChBhyXt7otUMZBRIhprlwZCDMmVBU7sHJGU1RlMPTDj0cpbkYA7lAZCdqtbImG2q9xMw70PbMf9zmKyGW7JcepR9kqcj1CQZDZD'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	state (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	header (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	seen_scopes	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,logger_id	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	sb	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	seen_scopes	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	header (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	logger_id ,fb_dtsg	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	datr	remove	unknown
Others	graph.facebook.com/v2.11/me	header (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	c_user	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fr	replace	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'link', u'https://www.facebook.com/app_scoped_user_id/YXNpZADpBWEhJaUFxQUVLdEZAVOTNwWnlsRGFLVldsOTFQYnY0dDhzUUE1TkxacUJTbzhJWldFa2d4NlBQMDFWZAUhVR0VDUDFERFFIZAGFtY0Q4T2k0UUJEY3F3dGtMWmRUTjJpUFNu/'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	state (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	signed_request (in response)	replace (value from toy app)	unknown
Others	graph.facebook.com/v2.11/me+++	first_name (in response)	randomize	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'last_name', u'Pat'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	datr	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	logger_id	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fb_dtsg	replace (value from toy app)	unknown
Others	graph.facebook.com/v2.11/me	link (in response)	remove	unknown
Others	graph.facebook.com/v2.11/me+++	[u'text', u'email', u'xxxxxxxx@hotmail.com'] (in response)	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me+++	[u'text', u'id', u'0000000000000'] (in response)	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me	name (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	header (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	Referer	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	Referer	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	sb	replace	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'id', u'0000000000000'] (in response)	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state ,seen_scopes	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	header (in response)	randomize	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'id', u'0000000000000'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state ,logger_id	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	datr	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	seen_scopes	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	[u'text', u'signed_request', u'KtyLf8pvfEUkKLb8CJ (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	xs	remove	unknown
Others	graph.facebook.com/v2.11/me+++	link (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,logger_id	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	c_user	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,__CONFIRM__	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	datr	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	signed_request (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me+++	header (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	[u'text', u'signed_request', u'CvrG6eBTXv0BVAy2 (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	logger_id	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	Referer	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	seen_scopes	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__ ,logger_id	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fb_dtsg	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	logger_id	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	state (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	first_name (in response)	remove	unknown
Others		state	misused	unknown
Others	graph.facebook.com/v2.11/me+++	name (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	logger_id	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	fr	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	[u'text', u'access_token', u'EAACZCDmPazpQBANJtSDxms6ouFy7FZCH5fcZBWBGw9rXc6b1dq81fuAYF0egN0qZBrVB36WAo1SG1jd49ZCpgpdTX8YJakRyb8ARyZBA6X9HAFxhDpsH7FuiKZAZAHfvjGm0KRj2t4Cuq8Cy2zKYnVvdjGi3CLtogjWXaK4SRjmi6O3RQEDW2LWS9ks7IaQZDZD'] (in response)	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__ ,fb_dtsg	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me	first_name (in response)	randomize	unknown
Others	graph.facebook.com/v2.11/me+++	last_name (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	[u'text', u'signed_request', u'w1ykdZZ5H608rW (in response)	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	encoded_state	remove	unknown
Others	graph.facebook.com/v2.11/me+++	link (in response)	remove	unknown
Others	graph.facebook.com/v2.11/me+++	[u'text', u'link', u'https://www.facebook.com/app_scoped_user_id/YXNpZmpkZAnJDbGZAwRjNmSjZA0QnFTa09DdTZASc3BQYUhacnhEQmM0a29Xd0FSd2ZANWVJ3bWZABbUdVQVp5dlFETVZAPOWJ4YzZAmdLYkpCR0JV/'] (in response)	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	state (in response)	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	[u'text', u'access_token', u'EAAGj4gTtSA0BAM5uhyY4mQpe3bgVHS8FD0ncerBRLG6r7PHcfi0ZBCaZB9j6iZBUlN0ZA8ttZCBCsrZBmYftxyDKkKODrKax0mrjhdo5eZCSu8myKLtJpQeXVKoTda3efaVXT5giJrwZDZD'] (in response)	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me	[u'text', u'first_name', u'Pat'] (in response)	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me+++	first_name (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	Referer	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state ,fb_dtsg	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	logger_id	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state ,seen_scopes	replace (value from toy app)	unknown
Others	graph.facebook.com/v2.11/me+++	[u'text', u'first_name', u'Pat'] (in response)	[u'rep', u'rep']	unknown
Others	graph.facebook.com/v2.11/me+++	header (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fb_dtsg	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	signed_request (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	header (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	header (in response)	remove	unknown
Others	graph.facebook.com/v2.11/me	name (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,fb_dtsg	replace (value from toy app)	unknown
Others	graph.facebook.com/v2.11/me+++	header (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	link (in response)	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state	remove	unknown
Others	graph.facebook.com/v2.11/me	link (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	__CONFIRM__	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	logger_id	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state ,__CONFIRM__	[u'rep', u'rep']	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	state (in response)	randomize	unknown
Others	graph.facebook.com/v2.11/me	last_name (in response)	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	fr	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	header (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me+++	first_name (in response)	replace	unknown
Others	graph.facebook.com/v2.11/me	name (in response)	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	c_user	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	encoded_state	randomize	unknown
Others	m.facebook.com/v2.11/dialog/oauth/confirm	fr	replace	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	sb	remove	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	read ,seen_scopes	replace (value from toy app)	unknown
Others	m.facebook.com/v2.11/dialog/oauth/read	signed_request (in response)	remove	unknown
Others	graph.facebook.com/v2.11/me+++	link (in response)	randomize	unknown

Showing 1 to 155 of 155 entries

Potential Vulnerabilities 1

critical 0 high 1 medium 0 low 0

Category	URL	Parameter	Action	Severity
Credential Disclosure	http://xxxxx.xxxxxxxx.xxxx/v1/app/0000000/facebook	access_token	disclosure	high

Showing 1 to 1 of 1 entries

Mobile SSO Tester