domains / families / security / okta-attack

okta-attack

authentic

Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use when recon shows `<tenant>.okta.com`, `<tenant>.okta-emea.com`, `<tenant>.oktapreview.com`, or autodiscover-style records pointing at Okta IdP.

When to use

• DNS shows `<tenant>.okta.com` or `<tenant>.okta-emea.com` (EMEA region)
• Login flow redirects to `<tenant>.okta.com/login` or `/app/<app_id>/sso/saml`
• Web pages reference `/signin/customize`, `oktapreview.com`, or `auth-js-sdk`
• Recon notes "uses Okta for SSO"
• A target has `*.okta.com` SAN in TLS cert
• Identity-fabric mapping returns Okta as IdP for a corporate app
• Entra ID (use `m365-entra-attack` instead)
• Google Workspace (use `google-workspace-attack` — not yet built)

When not to use

• Entra ID
• Google Workspace
• ADFS

Skill page

Source