hunt-oauth

Scan web applications for OAuth vulnerabilities and generate detailed reports.

Updated Jun 18, 2026

Search Tags:#OAuth #web security #vulnerability scanning #account takeover #session theft

Ready to run

npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-oauth-kisilev13

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-oauth
Source: https://github.com/Kisilev13/Hermes-Agent-Workspace/tree/main/skills/hunt-oauth
Command: npx skills add https://github.com/Kisilev13/Hermes-Agent-Workspace --skill hunt-oauth-kisilev13

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill is designed to uncover OAuth vulnerabilities that can lead to account takeover and session theft, enabling secure and compliant authentication practices.

Core Features & Use Cases

OAuth Vulnerability Scanning: Detects common OAuth vulnerabilities across various applications.
Attack Surface Enumeration: Identifies entry points where OAuth vulnerabilities might exist.
Mitigation Recommendations: Provides actionable steps to mitigate identified vulnerabilities.
Use Case: Before deploying a new web application, use this Skill to scan for OAuth vulnerabilities to ensure user data and account security.

Quick Start

Use the hunt-oauth skill to scan the application 'myapp.com' for OAuth vulnerabilities.

Frequently Asked Questions about hunt-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan web applications for OAuth vulnerabilities?▼

To scan web applications for OAuth vulnerabilities, identify attack surfaces like authorization endpoints, token exchange endpoints, and mobile deep link handlers to detect account takeover risks. The scan validates OAuth flow configurations and generates detailed security reports.

What are common OAuth attack vectors leading to account takeover?▼

Common OAuth attack vectors include insecure authorization endpoints, flawed token exchange endpoints, and improperly configured mobile deep link handlers. Exploiting these vulnerabilities often leads to session theft and full account takeover.

How do I find and validate insecure OAuth flow implementations?▼

Finding insecure OAuth flow implementations involves enumerating entry points and validating the configuration of access tokens and user sessions. This ensures secure handling across the entire authorization and token exchange process.

Does OAuth vulnerability scanning work for mobile deep link handlers?▼

Yes, OAuth vulnerability scanning works for mobile deep link handlers by identifying them as distinct attack surfaces. It validates their implementation to ensure secure token handling and prevent unauthorized session access.

What steps should I take to mitigate identified OAuth vulnerabilities?▼

To mitigate identified OAuth vulnerabilities, follow actionable recommendations provided in the scan report to secure access tokens and user sessions. This ensures compliant authentication practices and prevents session theft.

When should I scan my application for OAuth vulnerabilities?▼

You should scan your application for OAuth vulnerabilities before deploying a new web application to ensure user data and account security. This proactive approach uncovers session theft and account takeover risks early.