hunt-oauth

Test redirect_uri validation by trying host confusion ([email protected]), subdomain extension (legit.com.evil.com), path traversal with ../ sequences, parameter pollution with duplicate redirect_uri values, and encoded characters like %2F. Always verify with a real browser that the final navigation actually lands cross-origin.

The most common OAuth vulnerabilities are weak redirect_uri validation, missing or unvalidated state parameters enabling CSRF, nonce not verified after token exchange, and tokens leaking via Referer headers on callback pages. Mobile deep link handlers that accept arbitrary URLs are also frequent findings.

Find OAuth endpoints by spidering for /oauth, /connect, /auth, and /login paths, and by fetching .well-known/openid-configuration for full OIDC discovery. In JavaScript bundles and decompiled APKs, grep for redirect_uri, client_id, response_type, and intent:// patterns.

No, server-side acceptance is necessary but not sufficient for account takeover. The browser must actually navigate cross-origin, which depends on WHATWG URL parsing rules for userinfo and path boundaries. Always confirm the full chain with a headless browser test before claiming ATO severity.

Test state CSRF by removing the state parameter entirely, reusing a fixed state value across sessions, and checking whether validation happens server-side or only in client-side JavaScript. If state is not session-bound, you can link your OAuth identity to a victim's account by forcing them through your captured callback URL.

An OAuth finding is not reportable when you cannot complete the full attack chain from unauthenticated to authenticated as the victim. State-only leakage without token exposure is typically Low severity, and findings requiring unlikely victim behavior beyond clicking a link should document those dependencies explicitly.