oauth-sso-attack

Test OAuth 2.0 and OpenID Connect flows for redirect_uri, state, and token weaknesses.

1.6k|234|Updated Dec 7, 2019

Search Tags:#oauth #sso #oidc #csrf #openid #redirect_uri #token-leakage

Ready to run

npx skills add https://github.com/wgpsec/AboutSecurity --skill oauth-sso-attack

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: oauth-sso-attack
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/oauth-sso-attack
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill oauth-sso-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

OAuth 2.0 / SSO / OpenID Connect flows introduce complex trust boundaries that are easy to misconfigure, potentially leading to session takeover, token leakage, and improper access controls.

Core Features & Use Cases

Identifies and analyzes OAuth/Social login weaknesses across redirect_uri validation, state handling, token exposure, and scope uplift.
Provides concrete attack vectors, payload examples, and references to in-depth guidance for defensive testing.
Includes evaluation artifacts (evals/recalls) to benchmark agent performance in security scenario reasoning.

Quick Start

Apply the documented attack vectors to assess a target application's OAuth/Social login flow and verify defenses.

Frequently Asked Questions about oauth-sso-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test OAuth 2.0 redirect_uri validation weaknesses?▼

To test OAuth 2.0 redirect_uri validation, apply documented attack vectors like redirect_uri hijacking to evaluate if an application properly validates callback URLs and prevents session takeover. This includes verifying deterministic testing across web and mobile integrations.

What is a missing state parameter CSRF attack in OpenID Connect?▼

A missing state parameter CSRF attack in OpenID Connect exploits weak state handling during the authentication flow to hijack user sessions. It targets the trust boundary where the application fails to bind the authorization request to the user's active session.

How can I detect token leakage in SSO flows?▼

Detect token leakage in SSO flows by testing token exposure across service-to-service integrations and social login buttons. Use concrete payload examples to verify if access tokens are improperly transmitted or logged through insecure redirect endpoints.

Does this OAuth security testing approach work for mobile apps?▼

Yes, this OAuth security testing approach works for mobile apps by evaluating redirect_uri validation, state handling, and scope management across web, mobile, and service-to-service integrations to identify misconfigured trust boundaries.

What is the best way to prevent scope uplift in OAuth flows?▼

The best way to prevent scope uplift in OAuth flows is to analyze scope management controls using concrete attack vectors and payload examples. Verify that applications strictly enforce requested scopes against authorized permissions during the token issuance process.