skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

offensive-oauth

Identify OAuth flows and validate security posture across web, mobile, and SPA applications.

1|Updated Apr 27, 2026
Search Tags:#oauth#csrf#security-testing#token-security#pkce#redirect-uri#authorization-code
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-oauth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-oauth
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Red/Skills/offensive-oauth
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill offensive-oauth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OAuth 2.0 authentication and authorization flows are complex and frequently misconfigured, enabling token leakage, CSRF, open redirects, and account takeover. This skill provides a structured checklist to identify and remediate these weaknesses.

Core Features & Use Cases

  • Comprehensive OAuth 2.0/OIDC vulnerability checklist covering authorization code, PKCE, implicit flow, token handling, and redirect validation.
  • Guided testing workflows with step-by-step methodology and remediation recommendations.
  • Use cases include security assessments, bug bounty prep, and secure implementation hardening.

Quick Start

Load this skill and apply its OAuth security testing methodology to your target application's authorization flow.

Frequently Asked Questions about offensive-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit OAuth flows for token leakage and open redirect vulnerabilities?▼

Auditing OAuth flows requires validating redirect_uri strictness, state/nonce binding, and PKCE enforcement. This skill provides a structured checklist to identify and remediate authorization weaknesses like token leakage and open redirects across web and mobile apps.

What OAuth 2.0 vulnerabilities should I check during a security assessment?▼

During a security assessment, check authorization code, implicit flow, and token handling for CSRF and account takeover risks. This skill provides a comprehensive OAuth 2.0/OIDC vulnerability checklist with guided testing workflows and remediation recommendations.

Does this OAuth security testing methodology apply to SPAs and mobile apps?▼

Yes, this OAuth security testing methodology applies to web apps, mobile apps, and SPAs. It validates the security posture across these platforms by enforcing PKCE, state binding, and strict redirect_uri validation for OIDC implementations.

How do I validate PKCE enforcement and state binding in my authorization code flow?▼

Validating PKCE enforcement and state binding involves checking token validation mechanisms and threat modeling per OAuth best practices. This skill guides step-by-step testing workflows to ensure proper authorization code flow security posture.

When should I use an OAuth threat modeling checklist for bug bounty prep?▼

Use an OAuth threat modeling checklist during bug bounty prep to systematically uncover authorization abuse and token security flaws. This skill offers structured remediation guidance and vulnerability checks for misconfigured OIDC and OAuth flows.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-oauth

Detect OAuth 2.0 and OpenID Connect misconfigurations enabling redirect_uri bypasses and token leakage.

Community
Advanced
DorianGalloDorianGallo
5

oauth-oidc-misconfiguration

Identify OAuth 2.0 and OpenID Connect misconfigurations in login flows.

Community
Intermediate
utsavthakurutsavthakur

csrf-cross-site-request-forgery

Identify and analyze CSRF vulnerabilities in web applications.

Community
Advanced
xalgordxalgord
846

oauth2-oidc

Probe OAuth2/OIDC flows for PKCE bypass and token handling misconfigurations.

Community
Advanced