hunt-oauth

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Crown Jewel Targets

OAuth vulnerabilities are among the highest-value bug classes in web security because they directly enable **account takeover, session theft, and authentication bypass** — the trifecta that programs pay most for.

**Highest-value targets:**

- **Consumer identity providers** (Google, Facebook, PayPal, Apple SSO integrations) — any compromise cascades across all relying parties

- **Mobile apps with custom deep link OAuth handlers** — Android/iOS intent handling is notoriously loose

- **Multi-tenant SaaS platforms** (GitLab, Reddit-scale apps) where one OAuth flaw hits millions of accounts

- **Gaming/entertainment platforms** with federated login (Rockstar, Oculus) — often security-immature teams

- **Enterprise SSO connectors** — critical infrastructure, high severity payouts

**Asset types that pay most:**

- OAuth authorization endpoints (`/oauth/authorize`, `/connect/authorize`)

- Token exchange endpoints (`/oauth/token`)

- Mobile deep link handlers (`push_notification_webview`, custom scheme URIs)

- Social login callback handlers (`/auth/callback`, `/oauth/callback`)

**Typical payouts:** $500–$20,000+ depending on program; account takeover findings often hit max bounty.

---

Attack Surface Signals

URL Patterns to Hunt

/oauth/authorize
/oauth/token
/connect/authorize
/auth/callback
/oauth/callback
/login?redirect_uri=
/signin?next=
/auth?return_to=
/oauth/redirect
/push_notification_webview

Response Headers That Signal OAuth

Location: https://accounts.example.com/oauth/...
Set-Cookie: oauth_state=
WWW-Authenticate: Bearer
Content-Type: application/json (with access_token in body)

JavaScript Patterns (grep in JS bundles)

redirect_uri
client_id
response_type=code
response_type=token
state=
nonce=
oauth_token
access_token
push_notification_webview
deeplink
intent://

Tech Stack Signals

- Android apps with `intent-filter` in `AndroidManifest.xml` handling `http://` or custom scheme URIs

- Apps using Doorkeeper, OmniAuth, Devise (Ruby), Passport.js (Node), Spring Security OAuth

- Social login buttons (Google, Facebook, Apple) = OAuth surface guaranteed

- `.well-known/openid-configuration` present = full OIDC surface available

---

Step-by-Step Hunting Methodology

1. **Enumerate all OAuth entry points**

- Spider the app for `/oauth`, `/connect`, `/auth`, `/login` paths

- Check `.well-known/openid-configuration` and `.well-known/oauth-authorization-server`

- Decompile mobile APKs: `apktool d app.apk` and grep for `redirect_uri`, `intent://`, deep link schemes

2. **Map the full OAuth flow**

- Capture the authorization request: note `client_id`, `redirect_uri`, `state`, `nonce`, `response_type`

- Capture the callback: note where tokens/codes land, what validates state/nonce

3. **Test `redirect_uri` validation (highest yield)**

- Try exact host bypass: `redirect_uri=https://legit.com.evil.com`

- Try path traversal: `redirect_uri=https://legit.com/callback/../../../evil`

- Try open redirects on the legitimate domain first, then chain into OAuth

- Try parameter pollution: `redirect_uri