alaeddine001
Joined 6 years ago
Karma
59
Submissions
28
Member since
Nov 2
Recent submissions
Comment · 2 years ago
Comment · 2 years ago
Indeed the README page assumes familiarity with the scanner.
Updated the readme with the basic commands and referenced another tutorial with in-depth info: https://docs.ostorlab.co/tutorials/run-your-first-scan.html
Comment · 2 years ago
You are right, worth fixing.
Comment · 2 years ago
There is, see the section "Targetting all subdomains".
You can do so by adding your domain name generation tool of your choice, or all. The ones supported for now are `subfinder` and `amass`.
Agent Subfinder: https://github.com/Ostorlab/agent_subfinder Agent Amass: https://github.com/Ostorlab/agent_amass
Here are some key insights from the study: * Over 30% of the applications were released post-2021 * 67% of applications were updated in the last 3 months, and over 10% have not been updated in over 2 years. * 85% of applications include at least one vulnerable components * 55% of the applications have at least one high or critical severity vulnerability * 100% of the applications used encrypted communication but 20% still initiated some communication over clear text. * Over 20% of the applications suffered from the Biometric authentication bypass and 10% suffered from Authentication OAuth account takeover
For more details, you can check the analysis and results of the study here: https://blog.ostorlab.co/security-mobile-banking-app-landsca...