oauth-attacks

Testing OAuth 2.0 redirect_uri bypasses involves manipulating the redirect parameter in authorization requests to identify weak validation logic. This Skill automates endpoint discovery and bypass analysis to detect misconfigurations allowing code interception or malicious redirection.

Checking PKCE bypass and CSRF state parameter issues requires verifying missing or bypassable state validation and code challenge logic. This Skill evaluates OIDC token flow integrity to detect missing CSRF protections and exposed authorization codes.

Token leakage occurs when authorization codes or access tokens are exposed through HTTP Referer headers or insecure cross-origin postMessage calls. This Skill analyzes redirect handling and token transmission paths to identify these specific data exposure vulnerabilities.

Yes, you can use this Skill for enterprise apps and bug bounty security audits. It applies OAuth provider testing to redirect_uri handling, token flow integrity, and account takeover chains, generating clear evidence templates for reproducible findings.

Performing OAuth account takeover chain analysis involves identifying linked vulnerabilities like token leakage and CSRF to hijack user sessions. This Skill guides end-to-end testing of authorization flows to map exploit chains and validate takeover scenarios.