Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1635_steal-application-access-token
Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources.
Passed 17 of 22 test cases with the skill, and 11 of 22 without it.
and 5 more in the full report
6 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
A vulnerability management platform is configuring scope filters for T1635 threat evaluations. Which target mobile operating system platforms are in scope?
| Checked | Without skill | With skill |
|---|---|---|
| The scope report specifies Android as an in-scope platform. | Passed | Passed |
| The scope report specifies iOS as an in-scope platform. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering or URI hijacking and typically requires user action to grant access, such as through a system “Open With” dialogue.
Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS). OAuth is one commonly implemented framework used to issue tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry through OAuth 2.0 using a variety of authorization protocols. An example of a commonly-used sequence is Microsoft's Authorization Code Grant flow. An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested without requiring user credentials.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Steal Application Access Token by examining the target platforms (Android, iOS).
Review whether mitigations for T1635 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
iOS 11 introduced a first-come-first-served principle for URIs, allowing only the prior installed app to be launched via the URI. Android 6 introduced App Links.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.