skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

exploiting-oauth-misconfiguration

Detect OAuth 2.0 misconfigurations and token leakage in web applications.

Updated Apr 23, 2026
Search Tags:#oauth#web-security#oidc#pentest#security-assessment#redirect-uri#token-leakage
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill exploiting-oauth-misconfiguration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-oauth-misconfiguration
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/exploiting-oauth-misconfiguration
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill exploiting-oauth-misconfiguration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Identifying OAuth 2.0 and OpenID Connect misconfigurations that can lead to redirect URI bypasses, token leakage, and authorization code theft during security assessments.

Core Features & Use Cases

  • Detect redirect URI validation gaps and potential open redirect vectors.
  • Assess PKCE presence and strength in public clients.
  • Identify token leakage vectors and unsafe OAuth flows.
  • Provide actionable findings and remediation guidance for security teams.

Quick Start

Run the agent against your OAuth provider to initiate automated misconfiguration checks.

Frequently Asked Questions about exploiting-oauth-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect OAuth 2.0 redirect URI bypasses during a security assessment?▼

Detect OAuth 2.0 redirect URI validation gaps by running automated misconfiguration checks against your provider to identify open redirect vectors and potential authorization code theft.

What is the best way to check for PKCE presence and token leakage in OpenID Connect flows?▼

Check for PKCE presence and token leakage in OpenID Connect flows by analyzing public clients for PKCE strength and identifying unsafe OAuth flow vectors that leak tokens.

Does this OAuth security assessment support multiple providers and clients?▼

Yes, this OAuth security assessment supports authorized pentests across multiple providers and clients, enforcing checks for redirect URI validation, state handling, and PKCE.

How do I get actionable remediation guidance for OAuth misconfigurations?▼

Get actionable remediation guidance for OAuth misconfigurations by analyzing detected redirect URI bypasses and token leakage findings to provide security teams with fix recommendations.

Do I need the requests library to test OAuth token leakage vectors?▼

Yes, you need the requests library as a dependency to run the automated scripts that test for OAuth token leakage vectors and other OpenID Connect misconfigurations.

Why does my OAuth state handling check fail during pentest scanning?▼

OAuth state handling checks may fail during pentest scanning if state parameters are missing or improperly validated, which this assessment identifies as a security risk finding.

Related Skills

Explore More Software Engineering Skills→
AndreKuraitAndreKurait

pentesting-with-aws-security-agent

Automate web application pentests via AWS Security Agent APIs.

Community
Advanced
AuditwareAuditware
8

audit-extractor

Extract audit findings from PDF reports into a Markdown checklist.

Official
Intermediate
thejefflarsonthejefflarson
20

oauth-implementation

Enforce strict JWT validation and redirect URI matching in OAuth/OIDC implementations.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

oauth-attacks

Automate OAuth 2.0 and OpenID Connect vulnerability exploitation during authorized penetration tests.

Official
Advanced