domains / families / security / offensive-oauth

offensive-oauth

separate

OAuth 2.0 attack checklist covering authorization code interception, redirect_uri bypass, CSRF, state parameter abuse, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.

When to use

• OAuth 2.0 attack checklist
• authorization code interception
• redirect_uri bypass
• CSRF on OAuth flow
• state parameter abuse
• open redirector chaining
• token leakage via Referer
• PKCE bypass

Skill page

Source