skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

exploiting-oauth-misconfiguration

Tests OAuth 2.0 and OpenID Connect flows for redirect URI, state, PKCE, and token misconfigurations.

4|Updated Apr 28, 2026
Search Tags:#authentication#oauth#web-security#oidc#penetration-testing#pkce#redirect-uri
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-oauth-misconfiguration-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-oauth-misconfiguration
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/exploiting-oauth-misconfiguration
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill exploiting-oauth-misconfiguration-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? OAuth 2.0 and OpenID Connect implementations frequently contain misconfigurations—weak redirect URI validation, missing PKCE, absent state parameters, and reusable authorization codes—that enable account takeover and token theft. This Skill provides a structured methodology and an automated agent to identify these weaknesses during authorized penetration tests. ## Core Features & Use Cases - Redirect URI Bypass Testing: Probes 10 manipulation techniques including subdomain hijacking, path traversal, case variation, protocol downgrade, and CRLF injection. - Flow Security Validation: Checks state parameter enforcement (CSRF risk), PKCE requirements, authorization code reuse, and scope escalation attempts. - OIDC Discovery: Automatically fetches /.well-known/openid-configuration to locate authorization and token endpoints. - Use Case: During an authorized web application assessment, run the agent against the target's OAuth provider to produce a JSON report of accepted redirect URI bypasses and missing PKCE enforcement, then document findings in the provided report template. ## Quick Start Run the OAuth assessment agent against the target authorization server with the client ID and legitimate redirect URI to generate a JSON findings report.

Frequently Asked Questions about exploiting-oauth-misconfiguration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test OAuth redirect URI validation bypasses?▼

Submit authorization requests with manipulated redirect_uri values such as subdomain appending, path traversal, case variation, and protocol downgrade. The agent tests 10 bypass techniques and flags any the server accepts with a 2xx or 3xx response.

How to check if an OAuth flow requires PKCE?▼

Send an authorization request without a code_challenge parameter and compare the response to one with a valid S256 challenge. If the request without PKCE succeeds, the endpoint is vulnerable to authorization code interception attacks.

What tools are needed for OAuth penetration testing?▼

Burp Suite Professional for intercepting redirect chains, a browser with DevTools for monitoring token leakage, curl for manual flow testing, and the included Python agent which requires only the requests library.

Does the OAuth assessment agent work without OIDC discovery endpoints?▼

The agent first tries /.well-known/openid-configuration and /.well-known/oauth-authorization-server. If neither responds, it logs a warning and returns an empty configuration, so endpoint-dependent tests will not run.

Why is a missing state parameter a CSRF risk in OAuth?▼

Without a random state value binding the authorization request to the user's session, an attacker can craft a link that logs the victim into the attacker's account or links accounts, enabling account confusion and takeover attacks.

When should this OAuth testing approach not be used?▼

Only use it during authorized assessments with written permission covering OAuth and SSO flows. It is not suitable for production systems outside scope, and it does not cover JWT signature attacks, which require a dedicated JWT testing methodology.

Related Skills

Explore More Software Engineering Skills→
jcastillotxjcastillotx

IDOR Vulnerability Testing

Identify and test IDOR vulnerabilities by manipulating object references across API endpoints.

Community
Advanced
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

testing-jwt-token-security

Test JWT tokens for algorithm attacks, HMAC secrets, and claim vulnerabilities.

Community
Advanced
bpnrockstarbpnrockstar

dast-scanner

Automate DAST scanning with OWASP ZAP and nuclei, then import findings into a bug hunter database.

Community
Advanced