skills.rest
lycheer1126
lycheer1126COMMUNITY
Explore all skills by this author →
GitHub

oauth-sso

Tests OAuth 2.0, OIDC, and SSO implementations for redirect_uri, state, and token flaws.

2|1|Updated Aug 28, 2026
Search Tags:#oauth#penetration testing#sso#oidc#csrf#redirect-uri#token hijack
One-click install
npx skills add https://github.com/lycheer1126/xs-bigdan --skill oauth-sso-lycheer1126
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-sso
Source: https://github.com/lycheer1126/xs-bigdan/tree/main/knowledge/skills/oauth_sso
Command: npx skills add https://github.com/lycheer1126/xs-bigdan --skill oauth-sso-lycheer1126

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? OAuth and SSO integrations are common sources of account takeover vulnerabilities, but manually checking every attack vector (redirect_uri bypass, state CSRF, code reuse, PKCE downgrade) is error-prone and easy to skip under time pressure. This Skill gives a structured attack methodology so no high-value check is missed during authorized security testing. ## Core Features & Use Cases - redirect_uri Manipulation: Systematic bypass techniques including subdomain abuse, path traversal, CRLF injection, parameter pollution, and localhost bypasses. - State & CSRF Analysis: Detects missing or unvalidated state parameters that enable login CSRF and account binding attacks. - Token & Code Attacks: Covers authorization code reuse, client_secret leakage in JavaScript, implicit flow token exposure, PKCE bypass, and cross-tenant SSO token reuse. - Use Case: During an authorized SRC engagement against a target with third-party login (Google/WeChat/DingTalk), follow the checklist to test redirect_uri validation, verify state enforcement, and check whether an SSO token from one subdomain is accepted by another business system. ## Quick Start Ask the agent to assess the target's OAuth login flow using the oauth-sso methodology, starting with redirect_uri bypass attempts and state parameter validation.

Frequently Asked Questions about oauth-sso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth redirect_uri for open redirect bypasses?▼

Test redirect_uri validation by trying subdomain suffix tricks (app.target.com.evil.com), userinfo tricks ([email protected]), path traversal, CRLF injection, parameter pollution with duplicate redirect_uri values, and localhost callbacks. Any accepted variation can leak authorization codes to an attacker.

How to check if OAuth state parameter prevents CSRF attacks?▼

Verify the authorize request includes a state value and that the callback strictly validates it. If state is missing, removable, or unverified, an attacker can bind their own authorization code to a victim's session via a crafted callback link, achieving login CSRF.

Can OAuth authorization codes be reused to get multiple tokens?▼

Codes should be single-use. Obtain a legitimate code, then replay it multiple times against the token endpoint. If each attempt returns a valid access token, the code is not being invalidated after first use, which is a reportable vulnerability.

Does PKCE prevent all OAuth authorization code interception attacks?▼

Only if enforced. Test whether the code_challenge parameter can simply be omitted, whether plain method is accepted instead of S256, and whether code_verifier is properly validated at the token endpoint. Weak PKCE enforcement reopens code interception attacks.

What can the openid-configuration endpoint reveal during testing?▼

Requesting /.well-known/openid-configuration exposes authorization, token, userinfo, and jwks endpoints, plus sometimes a dynamic client registration endpoint. An open registration endpoint can let attackers register their own client and abuse the OAuth flow.

When should SSO token cross-domain reuse be tested?▼

Test it whenever a target has multiple subdomains or business systems sharing enterprise SSO (WeChat Work, DingTalk, Feishu). Check whether a token issued for one system is accepted by another's API and whether role permissions are properly isolated between systems.

Related Skills

Explore More Software Engineering Skills→
0X6C78790X6C7879

initial-access-recon

Map external attack surfaces with OSINT and subdomain enumeration.

Community
Advanced
jassicsjassics
6

finding

Document security findings with severity, evidence, impact, and remediation.

Community
Intermediate
braydos-hbraydos-h
4

testing-jwt-token-security

Tests JWT implementations for algorithm confusion, weak secrets, and authorization bypass vulnerabilities.

Community
Intermediate
Q16GQ16G
83

session-security

Audit session management for weak IDs, fixation risks, and cookie misconfigurations.

Community
Intermediate