skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-oauth

Identify high-severity OAuth vulnerabilities enabling account takeover and authentication bypass.

1.1k|191|Updated Jun 24, 2026
Search Tags:#oauth#penetration-testing#security-testing#bug-bounty#redirect-uri#account-takeover
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-oauth-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-oauth
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-oauth
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-oauth-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OAuth vulnerabilities are high-severity flaws that lead to account takeover, session theft, and authentication bypass, but most security testers lack a structured, field-validated methodology to identify them consistently during bug bounties and penetration tests.

Core Features & Use Cases

  • Proven Bug Bounty Techniques: Built from 19 public, verified bug bounty reports with real-world payloads and disclosed case studies from 2020-2024.
  • Comprehensive Testing Workflow: Step-by-step methodology covering redirect_uri validation bypasses, state/nonce CSRF testing, mobile deep link exploitation, referrer leakage detection, and client credential misconfiguration checks.
  • Defense Bypass Guidance: Specific bypass techniques for common security controls like exact-match redirect_uri whitelists, PKCE enforcement, and nonce validation.
  • Use Case: Ideal for bug bounty hunters, penetration testers, and security teams assessing platforms with social login, SSO integrations, OAuth authorization servers, and mobile apps with OAuth flows to find critical, high-payout vulnerabilities.

Quick Start

Use the hunt-oauth skill to test the target platform's OAuth authorization and token endpoints for critical vulnerabilities including redirect_uri bypasses, state parameter CSRF, and token leakage.

Frequently Asked Questions about hunt-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth redirect_uri validation bypasses for account takeover?▼

Testing OAuth redirect_uri bypasses requires a structured workflow that validates authorization endpoints against exact-match whitelist weaknesses, state parameter CSRF flaws, and token leakage to reproduce account takeover vulnerabilities.

What is a structured methodology for finding OAuth vulnerabilities in bug bounty programs?▼

An OAuth vulnerability methodology delivers step-by-step workflows covering redirect_uri validation bypasses, state/nonce CSRF testing, mobile deep link exploitation, referrer leakage detection, and client credential misconfiguration checks using validated payload sets and disclosed case studies.

Can I use this OAuth testing workflow for mobile deep link and SSO integrations?▼

Yes, the OAuth testing workflow supports assessing both web and mobile applications, specifically targeting social login, SSO integrations, OAuth authorization endpoints, and mobile deep link OAuth flows to identify critical vulnerabilities.

How do I bypass PKCE enforcement and nonce validation during OAuth security testing?▼

Bypassing PKCE enforcement and nonce validation involves applying specific defense bypass techniques derived from 19 verified bug bounty reports to circumvent common security controls on OAuth authorization and token endpoints.

What are the limitations of testing OAuth authorization endpoints for session theft?▼

Testing OAuth authorization endpoints for session theft is limited by individual bug bounty program rules, requiring testers to use disclosed case studies from 2020-2024 to validate and report flaws without exceeding authorized scope.

Related Skills

Explore More Software Engineering Skills→
Kisilev13Kisilev13

hunt-oauth

Scan web applications for OAuth vulnerabilities and generate detailed reports.

Community
Advanced
uphiagouphiago
1.1k

hunt-auth-bypass

Identify authentication bypass vulnerabilities in SAML, JWT, OAuth, and XMLRPC endpoints.

Community
Advanced
pdparchitectpdparchitect
13

hunt-oauth

Identify and exploit OAuth 2.0 and OIDC vulnerabilities in web and mobile applications.

Community
Advanced
vitoropereiravitoropereira

Cross-Site Scripting and HTML Injection Testing

Detect stored, reflected, and DOM-based XSS and HTML injection vulnerabilities in web applications.

Community
Advanced