Identify OAuth misconfigurations and token leakage in web and mobile apps.
npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-oauth-grivera82
Please help me install this Agent Skill. Skill: hunt-oauth Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/hunt-oauth Command: npx skills add https://github.com/grivera82/pi-bughunter --skill hunt-oauth-grivera82
OAuth implementations frequently suffer from misconfigurations that enable token leakage, session hijacking, and account takeover. This Skill helps security professionals rapidly identify and document these flaws across web apps and mobile clients.
Run the hunt-oauth workflow against a target to uncover OAuth misconfigurations and token leakage.
High-intent search queries and answers about installing and using this skill.
To test OAuth redirect_uri validation gaps, you map the application's OAuth surface and attempt bypasses using open-redirect payloads and wildcard domain configurations. This Skill helps identify weak validation and documents remediation steps for secure web callbacks.
Weak CSRF protection in OAuth state and nonce handling allows attackers to bypass authorization checks and hijack active sessions. This Skill detects missing or insufficient state validation to prevent session fixation and account takeover.
Yes, you can test OAuth mobile deep-link flows to identify insecure token delivery and callback vulnerabilities. This Skill guides security assessments across mobile clients to reproduce scenarios and document remediation steps for deep-link configurations.
The best way to document OAuth vulnerability findings is to map exposed surfaces, reproduce the exploit scenarios, and provide actionable remediation guidance. This Skill generates actionable findings that satisfy bug bounty requirements for detecting token leakage and misconfigurations.
Yes, this Skill detects open-redirect surfaces in web application OAuth implementations by identifying improper redirect_uri validation. It enables testers to map surfaces and reproduce scenarios where insecure token delivery leads to token leakage.
YukiIto1999Identify SSRF weaknesses by sending crafted URL parameters and inspecting responses.
vecearAudit authentication and authorization implementations for session, JWT, CSRF, MFA, and access control flaws.
AcczdyDetect OAuth 2.0 and OpenID Connect implementation flaws during security assessments.
YukiIto1999Detect OAuth 2.0 misconfigurations and token leakage in web applications.
