Collected research

Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies & Vulnerabilities

Abner Mendoza and Guofei Gu · people.engr.tamu.edu

WARDroid statically analyses Android apps to recover the HTTP templates and input-validation rules they enforce before calling their cloud APIs, then replays deliberately invalid requests to see whether the server enforces the same rules. Where it does not, an attacker skips the client-side checks and reaches data or actions the API should refuse; 10,000 apps were scanned.

Record

Researcher

Abner Mendoza and Guofei Gu

Published by

people.engr.tamu.edu

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2018 research round

Related sources

• Mobile Application Web API Reconnaissance

Tags

• auth-bypass
• filter-bypass
• rest-api
• android
• http
• static-analysis
• large-scale-scan
• tooling
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Abner Mendoza and Guofei Gu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.