domains / families / security / exploiting-oauth-misconfiguration

exploiting-oauth-misconfiguration

separate

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations

When to use

• During authorized penetration tests when the application uses OAuth 2.0 or OpenID Connect for authentication
• When assessing "Sign in with Google/Facebook/GitHub" social login implementations
• For testing single sign-on (SSO) flows between applications
• When evaluating API authorization using OAuth bearer tokens
• During security assessments of applications acting as OAuth providers or consumers

Skill page

Source