testing-oauth2-implementation-flaws

name	testing-oauth2-implementation-flaws
description	Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Use when working with testing oauth2 implementation flaws.
domain	cybersecurity
tags	["api-security","oauth2","oidc","authentication","redirect-uri","token-security"]
subdomain	api-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Testing Oauth2 Implementation Flaws

Overview

Cybersecurity skill for testing oauth2 implementation flaws. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "testing oauth2 implementation flaws"

• "Tests OAuth 2"

• Assessing OAuth 2.0 authorization code flow for redirect URI validation weaknesses

• Testing OAuth client applications for CSRF protection (state parameter usage) and PKCE enforcement

• Evaluating token storage, transmission, and lifecycle management in OAuth implementations

• Testing scope escalation where clients request more permissions than authorized

• Assessing OpenID Connect implementations for ID token validation and nonce usage

Do not use without written authorization. OAuth testing may result in token theft or unauthorized access.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Written authorization specifying the OAuth provider and client applications in scope
• Test OAuth client registered with the authorization server
• Burp Suite Professional for intercepting OAuth redirects and token flows
• Python 3.10+ with requests and oauthlib libraries
• Browser developer tools for observing OAuth redirect chains
• Knowledge of the OAuth 2.0 grant types in use (authorization code, implicit, client credentials)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}