okta-attack

Discover and exploit Okta authentication vulnerabilities for red-team security assessments.

5|Updated May 27, 2026

Search Tags:#authentication #vulnerability #penetration testing #red-team #security assessment #tenant discovery #Okta

Ready to run

npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill okta-attack-cybersecwoman

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: okta-attack
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/okta-attack
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill okta-attack-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, BeautifulSoup, requests-cache, cryptography, pysaml2, python-ldap, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive toolkit for identifying and exploiting vulnerabilities in Okta's authentication system, helping organizations assess their security posture against targeted attacks.

Core Features & Use Cases

Tenant Discovery: Automated discovery of Okta tenants based on DNS records and application HTTP flows.
User Enumeration: Enumeration of user accounts with various methods including API differential and timing attacks.
Authentication Flow Analysis: Analysis of authentication factors and their configurations to identify potential vulnerabilities.
Password Spray: Automated password spraying attacks with lockout discipline to identify valid passwords.
Push Notification Fatigue: Simulation of MFA bombing to test the vulnerability of push-based multi-factor authentication.
OIDC Redirect_URI Tampering: Tampering with Okta OIDC redirect URIs to steal authentication codes.
SAML SP Misconfiguration Check: Checks for misconfigurations in SAML Single Sign-On providers.
Okta Admin API: Access and enumeration of Okta Admin API endpoints post-compromise.
Phishing Kits: Information on Okta-specific phishing kits and tools for exploitation.
FastPass Abuse: Exploitation of Okta FastPass and Okta Verify features.
Common Tenant Configuration Patterns: Identification of common configuration patterns and indicators.
Tooling and Techniques: Recommendations for tools and techniques for post-compromise enumeration and attack.
Anti-Patterns and Takeaways: Guidance on common attack vectors, anti-patterns, and lessons learned from past incidents.

Quick Start

Use the okta-attack skill to discover Okta tenants for the target domain 'target.com'.

Frequently Asked Questions about okta-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform tenant discovery for an Okta authentication system?▼

Okta tenant discovery is performed by analyzing DNS records and application HTTP flows to identify target tenants. This Skill automates that process to map the authentication system's external footprint for red-team security assessments.

Can I test MFA push notification fatigue on Okta Verify?▼

Yes, you can test MFA push notification fatigue on Okta Verify by simulating MFA bombing attacks. This evaluates the vulnerability of push-based multi-factor authentication to user-approved flood attacks.

How do I enumerate Okta users without triggering lockouts?▼

You can enumerate Okta users using API differential analysis and timing attacks to identify valid accounts. For password validation, automated password spraying includes lockout discipline to avoid account lockouts.

Does this Skill check for SAML SP misconfigurations and OIDC redirect_uri tampering?▼

Yes, this Skill checks for SAML Single Sign-On provider misconfigurations and performs Okta OIDC redirect_uri tampering. These tests identify vulnerabilities that could allow attackers to steal authentication codes.

What Python dependencies are required for Okta red-team attacks?▼

Okta red-team attacks require Python 3.9+ and dependencies including requests, BeautifulSoup, requests-cache, cryptography, pysaml2, and python-ldap. These libraries support HTTP flow analysis, SAML parsing, and cryptographic operations.

How do I enumerate the Okta Admin API after compromising credentials?▼

You can enumerate the Okta Admin API post-compromise by accessing and querying specific administrative endpoints. This Skill facilitates endpoint enumeration to map tenant configurations and extract sensitive directory data.