skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oauth-attacks

Tests OAuth 2.0 implementations for redirect_uri bypass, CSRF, PKCE, and token leakage vulnerabilities.

Updated Sep 17, 2026
Search Tags:#oauth#security testing#penetration testing#pkce#bug bounty#redirect_uri#token leakage
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill oauth-attacks-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-attacks
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-oauth
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill oauth-attacks-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers and bug bounty hunters need a structured, comprehensive checklist when auditing OAuth 2.0 and OIDC implementations, since missing a single flow manipulation or token validation flaw can leave an application exposed to account takeover. ## Core Features & Use Cases - Attack Checklist: Covers authorization code interception, redirect_uri bypass, state parameter abuse, PKCE bypass, scope escalation, and token leakage via Referer. - Flow Analysis: Documents Authorization Code, Implicit, Device Code, and token exchange flows with mermaid diagrams, plus OAuth 2.1 and FAPI 1.0/2.0 security profiles. - Chaining & Escalation: Maps exploitation paths from OAuth flaws to full account takeover, lateral movement, and backend exploitation such as JWT algorithm confusion. - Use Case: During a web app pentest, intercept the OAuth flow with Burp Suite, then walk the checklist to test redirect_uri manipulation, missing state parameters, and refresh token rotation weaknesses, finishing with prioritized remediation recommendations. ## Quick Start Ask the assistant to audit the OAuth login flow of the target web application using the OAuth security testing checklist.

Frequently Asked Questions about oauth-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth redirect_uri for bypass vulnerabilities?▼

Intercept the authorization request and manipulate the redirect_uri parameter with external domains, subdomains, path traversal, or open redirect chains. If validation is weak, the authorization code is sent to an attacker-controlled endpoint, enabling account hijacking.

How to test OAuth state parameter for CSRF attacks?▼

Check whether the state parameter is missing, predictable, or not validated on the callback. Capture an authorization URL before the code is used and deliver it to a victim; if state is unverified, you can link accounts or force login via CSRF.

What tools are used for OAuth security testing?▼

The methodology references Burp Suite with the OAuth Scanner extension, OWASP ZAP, JWT_Tool for token analysis, and Postman for API testing. These support flow interception, parameter tampering, token analysis, and replay attacks.

Does PKCE prevent all OAuth authorization code attacks?▼

PKCE mitigates authorization code interception but only if the code_verifier is required and strictly validated by the server. Test for PKCE bypass by omitting the verifier, downgrading the challenge method, or targeting flows where PKCE is not enforced.

What are the limitations of OAuth implicit flow testing?▼

The implicit flow is deprecated in OAuth 2.1 because tokens are exposed in URL fragments, making them vulnerable to leakage via Referer headers and browser history. Modern testing should focus on Authorization Code with PKCE rather than implicit flows.

Related Skills

Explore More Software Engineering Skills→
Yenn503Yenn503
1

testing-for-open-redirect-vulnerabilities

Test web applications for open redirect vulnerabilities using bypass payloads and exploitation chains.

Community
Intermediate
SnailSploitSnailSploit
3.0k

oauth-attacks

Tests OAuth 2.0 implementations for redirect, state, PKCE, and token handling vulnerabilities.

Community
Intermediate
SnailSploitSnailSploit
2.9k

jwt-attacks

Test JSON Web Token implementations for security vulnerabilities.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced