domains / families / security / hunt-oauth

hunt-oauth

authentic

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

When to use

• hunting oauth vulnerabilities
• testing redirect_uri validation
• testing state parameter CSRF
• testing nonce parameter replay
• testing authentication step completeness
• hunting referrer leakage
• testing mobile deep links
• testing misconfigured client credentials

Skill page

Source