skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

oauth-flow-hijack

Detect and exploit OAuth flow hijack vulnerabilities in OAuth 2.0 and 2.1 implementations.

11|1|Updated May 4, 2026
Search Tags:#oauth#penetration testing#web security#pkce#account takeover#authorization code#flow hijack
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill oauth-flow-hijack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-flow-hijack
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/oauth-flow-hijack
Command: npx skills add https://github.com/dreadnode/capabilities --skill oauth-flow-hijack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the high risk of undetected OAuth flow hijack vulnerabilities in web applications, which can lead to unauthorized account access, data breaches, and identity theft when attackers intercept authorization codes or abuse OAuth callback flows.

Core Features & Use Cases

  • Redirect Stoppage & Code Leakage Techniques: Provides methods to block client-side OAuth redirects, leak authorization codes via navigation history, cookie bombing, and WAF bypasses, and exploit popup/iframe name collisions to hijack OAuth flows.
  • PKCE Downgrade & Framework-Specific Bypasses: Includes tests for PKCE enforcement gaps, plus documented exploits for common OAuth stack vulnerabilities like django-allauth mutable claim takeover and oauth2-proxy regex bypass.
  • Use Case: Security testers use this Skill during authorized penetration tests of web applications with OAuth authentication, especially when XSS on a subdomain, open redirects, or callback interception capabilities are present.

Quick Start

Use the oauth-flow-hijack skill to test a target OAuth implementation for redirect stoppage, authorization code leakage, and PKCE downgrade vulnerabilities during your next authorized penetration test.

Frequently Asked Questions about oauth-flow-hijack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth implementations for flow hijack vulnerabilities?▼

You can test OAuth flow hijack vulnerabilities by intercepting authorization codes through redirect stoppage, code leakage, and popup or iframe name collisions to identify account takeover risks during authorized penetration tests.

What is a PKCE downgrade attack in OAuth 2.0?▼

A PKCE downgrade attack exploits gaps in PKCE enforcement within OAuth 2.0 implementations, allowing attackers to bypass code verifier checks and intercept authorization codes during the callback flow.

Can I test django-allauth and oauth2-proxy for OAuth account takeover flaws?▼

Yes, you can test framework-specific OAuth bypasses targeting django-allauth mutable claim takeovers and oauth2-proxy regex bypasses to identify authorization code leakage and account hijack risks.

How do attackers leak OAuth authorization codes via redirect stoppage?▼

Attackers leak OAuth authorization codes by blocking client-side redirects, exploiting navigation history, cookie bombing, or bypassing WAFs to intercept the authorization code during the callback handling process.

When should I test OAuth callback handling for frame-ancestors protection?▼

You should test OAuth callback handling for frame-ancestors protection when assessing web applications where XSS on a subdomain, open redirects, or callback interception capabilities are present to prevent iframe name hijack risks.

Does OAuth 2.1 state parameter integrity prevent flow hijack attacks?▼

Testing state parameter integrity is crucial for preventing OAuth flow hijack attacks, as it validates callback handling and ensures authorization codes are not intercepted through PKCE downgrade or redirect manipulation.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
3.3k

hunt-open-redirect

Identify and exploit open redirect vulnerabilities and chained redirect workflows.

Community
Advanced
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-ato

Hunt account takeover paths across authentication and OAuth workflows.

Community
Advanced
SkobynSkobyn

hunt-auth-bypass

Discover and exploit authentication bypass vulnerabilities in web applications.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

oauth-attacks

Automate OAuth 2.0 and OpenID Connect vulnerability exploitation during authorized penetration tests.

Official
Advanced