skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

web-vuln-oauth

Detect OAuth 2.0 and OpenID Connect misconfigurations enabling redirect_uri bypasses and token leakage.

21|1|Updated Apr 12, 2026
Search Tags:#oauth#oidc#state#security-testing#pkce#redirect_uri#auth-code
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-oauth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-vuln-oauth
Source: https://github.com/woohyun212/security-skill/tree/main/web-vuln-oauth
Command: npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-oauth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies OAuth 2.0 and OpenID Connect misconfigurations that enable redirect_uri bypasses, missing PKCE enforcement, state parameter issues, authorization code leakage via Referer, implicit flow token exposure, and other paths to account takeover (ATO).

Core Features & Use Cases

  • Redirect URI Bypass Testing: Exercises 11 redirect_uri bypass techniques including open redirects, subdomain tricks, fragment abuse, double-encoding, IDN homographs, and scheme confusion to determine if an attacker can receive an authorization code or token.
  • PKCE and State Validation: Verifies enforcement of PKCE for public clients and checks presence, emptiness, and fixation of the state parameter to prevent interception and CSRF.
  • Token & Referer Leakage Checks: Detects implicit flow acceptance and presence of authorization codes in Referer headers when third-party resources are loaded, plus guides on documenting ATO impact chains.
  • Use Case: Security assessments, bug bounty reports, and authorization server audits for web, mobile, and SPA clients where third-party login or SSO is present.

Quick Start

Use the web-vuln-oauth skill to test example.com for redirect_uri bypasses, missing PKCE, state parameter weaknesses, and implicit flow token leakage.

Frequently Asked Questions about web-vuln-oauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for OAuth redirect_uri bypasses and authorization code leakage?▼

Test redirect_uri bypasses by exercising 11 techniques including open redirects, subdomain tricks, fragment abuse, and scheme confusion. Detect authorization code leakage via Referer headers when third-party resources load, and document full account takeover impact chains.

What is PKCE enforcement and how does it prevent OAuth token interception?▼

PKCE enforcement requires public clients to prove possession of an authorization code verifier, preventing malicious interception. Verify PKCE is enforced for mobile and SPA clients, and check state parameter presence to prevent CSRF attacks.

Can I audit OpenID Connect misconfigurations for single-page apps and mobile clients?▼

Yes, you can audit OpenID Connect misconfigurations for web, SPA, and mobile public clients. Detect implicit flow token exposure, missing PKCE enforcement, and state parameter fixation during security assessments or bug bounty hunting.

Why does the OAuth state parameter weakness lead to CSRF vulnerabilities?▼

The OAuth state parameter weakness leads to CSRF vulnerabilities because missing, empty, or fixated state values fail to bind the authorization request to the user session. Validate state parameter presence and randomness to prevent request interception.

Do I need an intercepting proxy to test OAuth 2.0 authorization server misconfigurations?▼

You need basic HTTP tooling like curl and an intercepting proxy for interactive flow analysis. Provide authorization and token endpoints, client_id, and registered redirect_uri to test OAuth 2.0 authorization server misconfigurations effectively.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

testing-oauth2-implementation-flaws

Detect OAuth 2.0 and OpenID Connect implementation flaws during security assessments.

Community
Intermediate
SnailSploitSnailSploit
2.9k

oauth-attacks

Test OAuth 2.0 and OIDC implementations for redirect_uri bypass and token leakage.

Community
Advanced
dapperdiversdapperdivers
1

vuln-scan

Scan web applications for vulnerabilities using nuclei and nikto.

Community
Advanced
balsm-healthbalsm-health
2

testing-oauth2-implementation-flaws

Assess OAuth 2.0 and OpenID Connect implementations for security flaws.

Official
Advanced