oauth-oidc-misconfiguration

Files (1)

• SKILL.md

SKILL.md (first lines)

---
name: oauth-oidc-misconfiguration
description: >-
  OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI
  handling, state and nonce validation, PKCE, token audience, callback binding,
  identity-provider trust flaws, and account takeover via OAuth flow manipulation.
---

# SKILL: OAuth/OIDC Misconfiguration — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: OAuth 2.0 and OpenID Connect misconfiguration covers redirect URI bypass, missing state parameter (CSRF), PKCE downgrade, token audience confusion, email-claim trust leading to account takeover, and implicit flow token leakage. Base models often test only the authorization code flow — this skill covers all grant types and OIDC-specific attack surfaces.

## QUICK START

### First-pass probes

| Situation | Check | Why |
|---|---|---|
| "Login with X" button | Examine redirect_uri parameter | Path traversal / open redirect bypass |
| OAuth callback visible | Check for `state` parameter | Missing state = CSRF |
| Token in URL fragment | Check URL after callback | Implicit flow leaks token |
| Multiple IdPs | Check account linking logic | Email claim trust = account takeover |
| PKCE flow | Check `code_challenge` presence | Missing PKCE = code interception |

### First-pass probe set

```text
# Redirect URI bypass:
redirect_uri=https://evil.com
redirect_uri=https://target.com/callback/../evil
redirect_uri=https://target.com/callback.evil.com
redirect_uri=https://target.com/callback%23@evil.com

# State parameter:
# Remove state entirely → still accepted?
# Replay state from different session → accepted?

# PKCE:
# Remove code_challenge → still works?
```

---

## 1. CORE CONCEPT

### OAuth 2.0 Flow (Authorization Code)

```
User → SP: "Login with IdP"
SP → IdP: Redirect to /authorize?redirect_uri=CALLBACK
IdP → User: Login + consent
IdP → SP: Redirect to CALLBACK?code=AUTH_CODE
SP → IdP: POST /token (exchange code for access_token)
SP → User: Authenticated
```

### OIDC Extensions

OIDC adds `id_token` (JWT containing user identity claims) and standardized userinfo endpoint.

### Key Parameters

| Parameter | Purpose | Attack Surface |
|---|---|---|
| `redirect_uri` | Where IdP sends the auth code | Bypass validation |
| `state` | CSRF protection for OAuth flow | Missing/replayed |
| `nonce` | Replay protection for id_token | Missing/replayed |
| `code_challenge` | PKCE: binds code to verifier | Downgrade/remove |
| `scope` | Permission request | Escalation |
| `aud` / `iss` | Token audience and issuer | Confusion attacks |

---

## 2. REDIRECT URI BYPASS

### Path Traversal

```text
# Original: redirect_uri=https://target.com/callback
# Bypass attempts:
redirect_uri=https://target.com/callback/../evil
redirect_uri=https://target.com/callback/../../evil
redirect_uri=https://target.com/callback%2F..%2Fevil
redirect_uri=https://target.com/callback%23
redirect_uri=https://target.com/callback?redirect=https://evil.com
```

### Subdomain / Domain Confusion

```text
redirect_uri=https://evil.target.com/callback
redirect_uri=https://target.com.evil.com/callback
redirect_uri=https://target.com@evil.com/callback
redirect_uri=https://target.com%00@evil.com/callback
```

### Fragment and Query Manipulation

```text
redirect_uri=https://target.com/callback%23@evil.com
redirect_uri=https://target.com/callback?foo=bar&redirect=evil.com
redirect_uri=https://target.com/callback#evil.com
```

### HTTP vs HTTPS

```text
redirect_uri=http://target.com/callback    # Downgrade to HTTP
redirect_uri=https://127.0.0.1/callback    # Loopback
redirect_uri=https://localhost/callback     # Localhost
```

---

## 3. STATE PARAMETER ISSUES

### Missing State → CSRF

```text
# Normal: /authorize?...&state=RANDOM

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC