hunt-oauth

What problem does it solve?

It helps you systematically hunt OAuth vulnerabilities that can lead to OAuth-based account takeover, session theft, and authentication bypass.

Core Features & Use Cases

• End-to-end OAuth flow mapping: Identify authorization endpoints, token exchange behavior, callback handling, and state/nonce usage across browser and mobile surfaces.
• High-yield vulnerability testing: Validate redirect_uri, test state CSRF weaknesses, check nonce replay/verification, and verify token endpoint completeness for prerequisite auth steps.
• Token/code exfiltration hunting: Detect referrer leakage and mobile deep link paths that redirect OAuth flows into attacker-controlled destinations.
• Built for real-world bug bounty hunting: Prioritize common OAuth/OIDC endpoints, common JS/APK signals, and frequent misconfiguration root causes.

Quick Start

Use hunt-oauth to produce an OAuth hunting plan for a target domain by instructing the AI to test redirect URI validation, state binding, and callback token leakage while focusing on the app’s browser and mobile deep link handlers.