skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

oauth-attacks

Automate OAuth 2.0 and OpenID Connect vulnerability exploitation during authorized penetration tests.

253|37|Updated Feb 22, 2026
Search Tags:#oauth#penetration testing#web security#oidc#authentication bypass#vulnerability exploitation
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill oauth-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-attacks
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/oauth-attacks
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill oauth-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit common vulnerabilities in OAuth 2.0 and OpenID Connect implementations, which are frequently used for authentication and authorization.

Core Features & Use Cases

  • Vulnerability Discovery: Maps OAuth endpoints and identifies common misconfigurations.
  • Exploitation Techniques: Provides detailed steps for redirect URI manipulation, state parameter bypass, authorization code theft, and token leakage.
  • Use Case: A penetration tester can use this Skill to find and exploit a redirect URI vulnerability, allowing them to steal an authorization code and gain unauthorized access to a user's account.

Quick Start

Use the oauth-attacks skill to test for redirect URI manipulation against the target application.

Frequently Asked Questions about oauth-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit OAuth 2.0 redirect URI manipulation vulnerabilities?▼

To exploit OAuth 2.0 redirect URI manipulation, this Skill automates testing by mapping endpoints and providing steps to bypass validation, allowing you to steal authorization codes during authorized penetration tests.

What is a state parameter bypass in OpenID Connect and how can I test for it?▼

A state parameter bypass in OpenID Connect occurs when anti-CSRF protections are missing or flawed. This Skill helps penetration testers identify and exploit this vulnerability to perform authentication bypasses.

Do I need Burp Suite to test for OAuth token leakage and authorization code theft?▼

Yes, you need Burp Suite and curl to comprehensively test for OAuth token leakage and authorization code theft. These tools are required for intercepting traffic and automating vulnerability analysis.

What is the best way to find OpenID Connect specific flaws during a penetration test?▼

The best way to find OpenID Connect specific flaws is to automate endpoint mapping and vulnerability discovery. This Skill identifies misconfigurations and details exploitation techniques for authorized testing.

Can I use this Skill to automate testing for OAuth authentication bypass on web applications?▼

Yes, you can use this Skill to automate testing for OAuth authentication bypass on web applications. It focuses on identifying misconfigurations like token leakage and redirect URI manipulation to gain unauthorized access.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

Burp Suite Web Application Testing

Intercept and analyze HTTP traffic with Burp Suite proxy tools.

Community
Advanced
balsm-healthbalsm-health
2

testing-jwt-token-security

Test JWT tokens for cryptographic weaknesses, algorithm confusion, and authorization bypass.

Official
Advanced
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced
SkobynSkobyn

hunt-oauth

Identify OAuth vulnerabilities in web applications via HTTP responses and JavaScript.

Community
Advanced