MoScan: a model-based vulnerability scanner for web single sign-on services