okta-attack

Name: okta-attack
Availability: InStock
Author: entrovyx

Discover Okta tenants and analyze authentication flows for security misconfigurations.

3|1|Updated Jul 2, 2026

Search Tags:#security #authentication #identity #pentest #redteam #okta

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill okta-attack-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: okta-attack
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/okta-attack
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill okta-attack-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3.

What problem does it solve?

This skill streamlines the complex process of auditing Okta identity environments by providing a structured, impact-driven workflow for discovering tenants, analyzing authentication flows, and identifying misconfigurations.

Core Features & Use Cases

Tenant Discovery: Identify Okta tenants through DNS analysis and HTTP flow inspection.
Auth Flow Analysis: Map MFA factor configurations and identify phishing-resistant vs. phishable primitives.
Security Assessment: Safely test for OIDC redirect URI tampering, SAML SP misconfigurations, and admin API surface exposure.

Quick Start

Use the okta-attack skill to perform tenant discovery and authentication flow analysis on the target domain example.com.

Frequently Asked Questions about okta-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover Okta tenants during a red-team engagement?▼

Discover Okta tenants by analyzing target DNS records and inspecting HTTP flows. This skill automates tenant identification through systematic probing of Okta-specific endpoints to map the identity provider infrastructure.

How can I check if Okta MFA factors are phishing-resistant?▼

Check Okta MFA factors by mapping authentication flow configurations to identify phishing-resistant versus phishable primitives. This skill automates auth flow analysis to highlight weak multi-factor authentication setups.

How do I test for Okta OIDC redirect URI misconfigurations?▼

Test Okta OIDC redirect URI misconfigurations by probing administrative API surfaces and authentication endpoints. This skill validates security posture by safely checking for tampering vulnerabilities in OIDC configurations.

Can I assess Okta admin API surface exposure with Python?▼

Assess Okta admin API exposure using Python3 and standard network utilities. This skill requires HTTP request capabilities to probe Okta-specific endpoints and validate the security posture of administrative interfaces.

What is needed to perform authorized Okta security assessments?▼

Authorized Okta security assessments require Python3, standard network utilities, and HTTP request capabilities. You must have explicit authorization for red-team engagements before probing tenant endpoints and SAML SP configurations.