web-vuln-oauth

What this skill does

Tests OAuth 2.0 and OpenID Connect implementations for misconfigurations that lead to account takeover (ATO). Covers 11 redirect_uri bypass techniques, missing PKCE enforcement, state parameter absence or fixation, authorization code theft via Referer leakage, scope escalation, implicit flow abuse, and token leakage in browser history.

When to use

• When a target application has a "Login with ..." button (Google, GitHub, Facebook, or custom OAuth provider)
• When auditing first-party OAuth authorization servers
• When testing mobile or SPA clients that should enforce PKCE
• During bug bounty on any scope that includes authentication or SSO

Prerequisites

• curl installed
• Burp Suite (recommended for intercepting and replaying authorization flows)
• Two test accounts on the target application
• The application's client_id and authorization endpoint (obtainable from page source or network traffic)

Inputs

Variable	Description	Example
AUTH_ENDPOINT	OAuth authorization endpoint	https://auth.example.com/oauth2/authorize
TOKEN_ENDPOINT	OAuth token endpoint	https://auth.example.com/oauth2/token
CLIENT_ID	OAuth client_id for the application	abc123client
REDIRECT_URI	Registered redirect_uri	https://app.example.com/callback
SCOPE	Requested scopes	openid profile email

Workflow

Step 1: Identify OAuth endpoints

AUTH_ENDPOINT="https://auth.example.com/oauth2/authorize"
TOKEN_ENDPOINT="https://auth.example.com/oauth2/token"
CLIENT_ID="abc123client"
REDIRECT_URI="https://app.example.com/callback"
SCOPE="openid profile email"

# Check for OIDC discovery document (reveals all endpoints)
ISSUER="https://auth.example.com"
curl -s "$ISSUER/.well-known/openid-configuration" | python3 -m json.tool
curl -s "$ISSUER/.well-known/oauth-authorization-server" | python3 -m json.tool

Step 2: Test redirect_uri bypass techniques