web-vuln-oauth

What this skill does

Tests OAuth 2.0 and OpenID Connect implementations for misconfigurations that lead to account takeover (ATO). Covers 11 redirect_uri bypass techniques, missing PKCE enforcement, state parameter absence or fixation, authorization code theft via Referer leakage, scope escalation, implicit flow abuse, and token leakage in browser history.

When to use

• When a target application has a "Login with ..." button (Google, GitHub, Facebook, or custom OAuth provider)
• When auditing first-party OAuth authorization servers
• When testing mobile or SPA clients that should enforce PKCE
• During bug bounty on any scope that includes authentication or SSO

Prerequisites

• curl installed
• Burp Suite (recommended for intercepting and replaying authorization flows)
• Two test accounts on the target application
• The application's client_id and authorization endpoint (obtainable from page source or network traffic)

Inputs