<commit_before># ACMate-Lite

ACMate is a framework for testing and reverse-engineering access control (AC) policies. It is developed by the SVV Laboratory, SnT, University of Luxembourg.

Here you can download the light weight version of the ACMate tool with the basic functions for access control testing.

ACMate-Lite is a Java-based extension module for Burp Suite (http://protswigger.net/burp/) that can be loaded and run seamlessly with Burp Suite proxy and spider. ACMate-Lite provides hand-on testing functions to support the Web application developers to test the access control implemented in their web-based products.
ACMate-Lite contains the following key components:
* Mining input specification from logs
* Smartly generating AC requests using pairwise combination strategy
* Executing AC tests, taking into account contextual parameters

## Install

### Binary 

You can download the binary file of ACMate-Lite <a href="https://github.com/lehathanh/acmate/blob/master/acmate-lite.jar">here</a>.

### Source

... or from source:
``` 
git clone https://github.com/lehathanh/acmate.git
```
and build the binary file in Eclipse using Ant.

### Import to Burp Suite

ACMate-Lite works as an extension in Burp Suite. Please refer to <a href="https://support.portswigger.net/customer/portal/articles/1965930-how-to-install-an-extension-in-burp-suite">this instruction</a> for its installation.

## User Guide

User guide is available <a href="https://github.com/lehathanh/acmate/blob/master/docs/ACMate-Lite%20Documentation%20Short.pdf">here</a>.

# ACMate Full version

ACMate provides additional features to assist AC testing as following: 
* AC policy inference, where AC policies are learned after the AC logs are obtained and analysed from the AC tests
* Assessment and Issues detection: ACMate highlights the inferred AC policies in three categories: "allowed", "denied" and "unclassified". This feature assissts the tester to quickly locate and assess the AC policies that may relate to potential AC issues in the tested web application.

If you are interested in the ACMate, please contact us: <a href="mailto:<EMAIL>?Subject=ACMate" target="_top"><EMAIL></a>

#Bibliography

* <NAME>, <NAME>, <NAME>, and <NAME>. Automated inference of access control policies for web applications. In Proceedings of the 20th ACM Symposium on Access Control Models and Technologies, SACMAT ’15, pages 27–37, New York, NY, USA, 2015. ACM. (<a href="https://publications.uni.lu/handle/10993/20786">download</a>)<commit_msg>added information of ACMate full version<commit_after># ACMate-Lite

ACMate is a framework for testing and reverse-engineering access control (AC) policies. It is developed by the SVV Laboratory, SnT, University of Luxembourg.

Here you can download the light weight version of the ACMate tool with the basic functions for access control testing.

ACMate-Lite is a Java-based extension module for Burp Suite (http://protswigger.net/burp/) that can be loaded and run seamlessly with Burp Suite proxy and spider. ACMate-Lite provides hand-on testing functions to support the Web application developers to test the access control implemented in their web-based products.
ACMate-Lite contains the following key components:
* Mining input specification from logs
* Smartly generating AC requests using pairwise combination strategy
* Executing AC tests, taking into account contextual parameters

## Install

### Binary 

You can download the binary file of ACMate-Lite <a href="https://github.com/lehathanh/acmate/blob/master/acmate-lite.jar">here</a>.

### Source

... or from source:
``` 
git clone https://github.com/lehathanh/acmate.git
```
and build the binary file in Eclipse using Ant.

### Import to Burp Suite

ACMate-Lite works as an extension in Burp Suite. Please refer to <a href="https://support.portswigger.net/customer/portal/articles/1965930-how-to-install-an-extension-in-burp-suite">this instruction</a> for its installation.

## User Guide

User guide is available <a href="https://github.com/lehathanh/acmate/blob/master/docs/ACMate-Lite%20Documentation%20Short.pdf">here</a>.

# ACMate Full version

ACMate provides additional features to assist AC testing as following: 
* AC policy inference, where AC policies are learned after the AC logs are obtained and analysed from the AC tests
* Assessment and Issues detection: ACMate highlights the inferred AC policies in three categories: "allowed", "denied" and "unclassified". This feature assissts the tester to quickly locate and assess the AC policies that may relate to potential AC issues in the tested web application.

If you are interested in the ACMate, please contact us: <a href="mailto:<EMAIL>?Subject=ACMate" target="_top"><EMAIL></a>

#Bibliography

* <NAME>, <NAME>, <NAME>, and <NAME>. Automated inference of access control policies for web applications. <i>In Proceedings of the 20th ACM Symposium on Access Control Models and Technologies</i>, SACMAT ’15, pages 27–37, New York, NY, USA, 2015. ACM. (<a href="https://publications.uni.lu/handle/10993/20786">download</a>)
{'fraction_non_alphanumeric': 0.08609141055949567, 'fraction_numerical': 0.013002364066193853, 'mean_word_length': 4.938011695906432, 'pattern_counts': {'":': 0, '<': 37, '<?xml version=': 0, '>': 37, 'https://': 10, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3033966', 'n_tokens_mistral': 1459, 'n_tokens_neox': 1370, 'n_words': 606}