hunt-oauth

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Crown Jewel Targets

OAuth vulnerabilities are among the highest-value bug classes in web security because they directly enable account takeover, session theft, and authentication bypass — the trifecta that programs pay most for.

Highest-value targets:

• Consumer identity providers (Google, Facebook, PayPal, Apple SSO integrations) — any compromise cascades across all relying parties
• Mobile apps with custom deep link OAuth handlers — Android/iOS intent handling is notoriously loose
• Multi-tenant SaaS platforms (GitLab, Reddit-scale apps) where one OAuth flaw hits millions of accounts
• Gaming/entertainment platforms with federated login (Rockstar, Oculus) — often security-immature teams
• Enterprise SSO connectors — critical infrastructure, high severity payouts

Asset types that pay most:

• OAuth authorization endpoints (/oauth/authorize, /connect/authorize)
• Token exchange endpoints (/oauth/token)
• Mobile deep link handlers (push_notification_webview, custom scheme URIs)
• Social login callback handlers (/auth/callback, /oauth/callback)

Typical payouts: $500–$20,000+ depending on program; account takeover findings often hit max bounty.

Attack Surface Signals

URL Patterns to Hunt

/oauth/authorize
/oauth/token
/connect/authorize
/auth/callback
/oauth/callback
/login?redirect_uri=
/signin?next=
/auth?return_to=
/oauth/redirect
/push_notification_webview

Response Headers That Signal OAuth

Location: https://accounts.example.com/oauth/...
Set-Cookie: oauth_state=
WWW-Authenticate: Bearer
Content-Type: application/json (with access_token in body)

JavaScript Patterns (grep in JS bundles)

redirect_uri
client_id
response_type=code
response_type=token
state=
nonce=
oauth_token
access_token
push_notification_webview
deeplink
intent://

Tech Stack Signals

• Android apps with intent-filter in AndroidManifest.xml handling http:// or custom scheme URIs
• Apps using Doorkeeper, OmniAuth, Devise (Ruby), Passport.js (Node), Spring Security OAuth
• Social login buttons (Google, Facebook, Apple) = OAuth surface guaranteed
• .well-known/openid-configuration present = full OIDC surface available

Step-by-Step Hunting Methodology

1. Enumerate all OAuth entry points

   • Spider the app for /oauth, /connect, /auth, /login paths
   • Check .well-known/openid-configuration and .well-known/oauth-authorization-server
   • Decompile mobile APKs: apktool d app.apk and grep for redirect_uri, intent://, deep link schemes

2. Map the full OAuth flow

   • Capture the authorization request: note client_id, redirect_uri, state, nonce, response_type
   • Capture the callback: note where tokens/codes land, what validates state/nonce

3. Test redirect_uri validation (highest yield)

   • Try exact host bypass: redirect_uri=https://legit.com.evil.com
   • Try path traversal: redirect_uri=https://legit.com/callback/../../../evil
   • Try open redirects on the legitimate domain first, then chain into OAuth
   • Try parameter pollution: redirect_uri=https://legit.com&redirect_uri=https://evil.com
   • Try encoded characters: %2F, %40, %23 to confuse parsers

4. Test state parameter (CSRF)

   • Remove state entirely — does the flow complete?
   • Reuse a fixed state value across sessions
   • Check if state is validated server-side or only client-side

5. Test nonce parameter (replay/bypass)

   • Capture a nonce from one flow, attempt to replay it in another
   • Check if nonce is validated after token exchange

…