skills.rest
erkanrzgc
erkanrzgcCOMMUNITY
Explore all skills by this author →
Website𝕏@erkan_rzgcGitHub

oauth-attacks

Identify and validate OAuth 2.0 flow weaknesses and token handling vulnerabilities.

1|1|Updated Mar 4, 2026
Search Tags:#oauth#oauth2#csrf#penetration-testing#security-testing#pkce#redirect-uri
One-click install
npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill oauth-attacks-erkanrzgc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-attacks
Source: https://github.com/erkanrzgc/cyberm4fia-scanner/tree/main/core/ai_skills/offensive-oauth
Command: npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill oauth-attacks-erkanrzgc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OAuth security testing helps identify weaknesses in OAuth 2.0 implementations, including redirect_uri validation, state/nonce handling, PKCE gaps, and token leakage risks, enabling secure deployments.

Core Features & Use Cases

  • Flow analysis: Assess authorization code, PKCE, implicit, and hybrid flows for misconfigurations.
  • Threat modeling: Detect open redirects, CSRF, and token handling flaws across web, mobile, and SPAs.
  • Remediation guidance: Provide concrete mitigations and best practices for OAuth security.

Quick Start

Run the OAuth security testing methodology against the target application to identify weak redirects, CSRF, PKCE gaps, and token handling issues.

Frequently Asked Questions about oauth-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth 2.0 redirect_uri validation for open redirect vulnerabilities?▼

Testing OAuth 2.0 redirect_uri validation requires analyzing the authorization server's redirect URI handling to detect open redirect attack vectors. This Skill automates checking for weak redirect_uri validation across web, mobile, and SPA deployments.

Can I detect CSRF and state parameter weaknesses in OAuth authorization flows?▼

Detecting CSRF and state parameter weaknesses involves analyzing OAuth state and nonce parameter validation across authorization code flows. This Skill identifies insufficient state checks to prevent cross-site request forgery during the authorization process.

Does this OAuth security testing methodology work with mobile and SPA applications?▼

This OAuth security testing methodology works with web, mobile, and SPA deployment contexts. It evaluates PKCE gaps, implicit flow misuse, and token leakage risks tailored to the specific architecture of your application.

What is the best way to identify PKCE gaps in OAuth 2.0 implementations?▼

Identifying PKCE gaps requires analyzing the authorization code flow for missing or improperly validated code challenge and verifier parameters. This Skill detects these gaps to prevent authorization code interception attacks.

How do I validate token binding mechanisms like MTLS and DPoP in OAuth?▼

Validating MTLS and DPoP token bindings involves checking if access tokens are cryptographically linked to client certificates or proof-of-possession keys. This Skill automates verifying these bindings to prevent token replay attacks.

Why does my OAuth token keep leaking across different application platforms?▼

OAuth token leakage happens when tokens are exposed via insecure storage, implicit flow misuse, or improper handling in web and mobile apps. This Skill identifies specific token leakage scenarios across deployment contexts to provide remediation guidance.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-oauth

Detect OAuth 2.0 and OpenID Connect misconfigurations enabling redirect_uri bypasses and token leakage.

Community
Advanced
tech-leads-clubtech-leads-club
5.0k

security-best-practices

Analyze Python, JavaScript/TypeScript, and Go codebases for security best practices.

Official
Advanced
AcczdyAcczdy
2

testing-oauth2-implementation-flaws

Detect OAuth 2.0 and OpenID Connect implementation flaws during security assessments.

Community
Intermediate
Renzo-TognellaRenzo-Tognella

testing-api-authentication-weaknesses

Test API authentication mechanisms for token validation and session flaws.

Community
Advanced