skills.rest
SnailSploit
SnailSploitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oauth-attacks

Test OAuth 2.0 and OIDC implementations for redirect_uri bypass and token leakage.

2.9k|469|Updated Mar 4, 2026
Search Tags:#authorization#security#authentication#oauth#vulnerability testing#oidc
One-click install
npx skills add https://github.com/SnailSploit/Claude-Red --skill oauth-attacks-snailsploit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-attacks
Source: https://github.com/SnailSploit/Claude-Red/tree/main/Skills/offensive-oauth
Command: npx skills add https://github.com/SnailSploit/Claude-Red --skill oauth-attacks-snailsploit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the complex security landscape of OAuth 2.0 and OIDC, helping to identify and mitigate vulnerabilities in authentication and authorization flows.

Core Features & Use Cases

  • Vulnerability Identification: Detects common flaws like redirect_uri bypass, CSRF, state parameter abuse, and token leakage.
  • Attack Simulation: Provides methodologies to test PKCE bypass, scope escalation, and account takeover scenarios.
  • Use Case: When testing a web application that uses OAuth for login, use this Skill to systematically check for all known OAuth-related vulnerabilities and ensure robust security.

Quick Start

Use the oauth-attacks skill to test for improper redirect_uri validation in the current OAuth flow.

Frequently Asked Questions about oauth-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for OAuth 2.0 redirect_uri bypass vulnerabilities?▼

Testing for OAuth 2.0 redirect_uri bypass involves manipulating the authorization request's redirect_uri parameter to detect insufficient validation. This identifies potential token leakage risks by enforcing strict matching protocols.

What is a PKCE bypass attack in OIDC and OAuth flows?▼

A PKCE bypass in OAuth and OIDC flows targets improper code verifier implementation to intercept authorization codes. Simulating this attack verifies robust code challenge validation and secures the flow against interception.

How can I prevent CSRF and state parameter abuse in OAuth authentication?▼

Preventing CSRF and state parameter abuse in OAuth authentication requires binding the state parameter cryptographically to the user session. Testing confirms this parameter effectively blocks unauthorized authorization code injection.

Does this methodology cover scope escalation and account takeover scenarios?▼

Yes, the methodology covers scope escalation and account takeover scenarios through attack simulation. It tests strict token claim validation and secure storage to verify prevention of unauthorized privilege elevation.

When do I need to validate token claims against OAuth 2.1 and FAPI standards?▼

Validating token claims against OAuth 2.1 and FAPI standards is required when securing complex authorization flows against token leakage. This ensures strict modern protocol adherence and mitigates account takeover vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

auth-sec

Route authentication and authorization testing tasks across login flows, sessions, and identity protocols.

Community
Intermediate
SkobynSkobyn

hunt-oauth

Identify OAuth vulnerabilities in web applications via HTTP responses and JavaScript.

Community
Advanced
dreadnodedreadnode
11

oauth-flow-hijack

Detect and exploit OAuth flow hijack vulnerabilities in OAuth 2.0 and 2.1 implementations.

Official
Advanced
00PrabalK0000PrabalK00
1

secrets-config-sanitizer

Detect hard-coded secrets and configuration leakage in code and deployment files.

Community
Advanced