configuring-oauth2-authorization-flow

Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.

Aller à l'installation

Dépôt: mukul975/Anthropic-Cybersecurity-Skills
Dernière activité de la source: 2 août 2026 à 16:32
Langue détectée de SKILL.md: anglais
Étoiles: 27 732
Forks: 3 366

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill configuring-oauth2-authorization-flow

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

8 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

Tout voir dans ce dépôt

Configuring OAuth 2.0 Authorization Flow

Overview

Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token lifecycle management, scope design, and alignment with OAuth 2.1 security requirements.

When to Use

When deploying or configuring configuring oauth2 authorization flow capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with identity access management concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Implement Authorization Code flow with PKCE for public and confidential clients
Configure Client Credentials flow for machine-to-machine communication
Design least-privilege scope hierarchies
Implement secure token storage, refresh, and revocation
Apply OAuth 2.1 best practices and RFC 9700 security recommendations
Validate token integrity and prevent common OAuth attacks

Key Concepts

OAuth 2.0 Grant Types

Authorization Code + PKCE: Recommended for all client types (web, mobile, SPA). PKCE is mandatory in OAuth 2.1.
Client Credentials: Machine-to-machine authentication without user context.
Device Authorization Grant (RFC 8628): For input-constrained devices (smart TVs, CLI tools).
Refresh Token: Long-lived token to obtain new access tokens without re-authentication.

PKCE (Proof Key for Code Exchange)

PKCE (RFC 7636) prevents authorization code interception attacks:

Client generates random code_verifier (43-128 characters, unreserved URI chars)
Client computes code_challenge = BASE64URL(SHA256(code_verifier))
Authorization request includes code_challenge and code_challenge_method=S256
Token request includes original code_verifier
Server validates SHA256(code_verifier) matches stored code_challenge

Token Types

Access Token: Short-lived (5-60 min), bearer or DPoP-bound
Refresh Token: Long-lived, single-use with rotation
ID Token (OIDC): JWT containing user identity claims

Workflow

Step 1: Authorization Code Flow with PKCE

Generate cryptographically random code_verifier (min 43 chars)
Compute code_challenge using S256 method
Redirect user to authorization endpoint with parameters:
- response_type=code
- client_id, redirect_uri, scope, state
- code_challenge, code_challenge_method=S256
User authenticates and consents
Authorization server redirects with authorization code
Exchange code + code_verifier for tokens at token endpoint
Validate state parameter matches original value

Step 2: Scope Design

Define granular scopes: read:users, write:orders, admin:settings
Follow least-privilege: request minimum scopes needed
Implement scope validation on resource server
Document scope hierarchy and consent requirements

Step 3: Token Security

Store tokens securely (httpOnly cookies for web, keychain for mobile)
Implement token refresh with rotation (one-time-use refresh tokens)
Set appropriate expiration: access tokens 5-15 min, refresh tokens 8-24 hrs
Enable DPoP (Demonstration of Proof-of-Possession) for sender-constrained tokens
Implement token revocation endpoint

Step 4: Client Credentials Flow

Register service client with client_id and client_secret
Request token: POST /oauth/token with grant_type=client_credentials
Include scope for required permissions
Store client_secret securely (vault, env vars, not code)
Implement certificate-based client authentication for higher assurance

Step 5: Security Hardening

Enforce PKCE for all authorization code flows
Use exact redirect URI matching (no wildcards)
Implement CSRF protection with state parameter
Enable refresh token rotation and revocation on reuse detection
Apply RFC 9700 security best practices
Block implicit grant and ROPC (removed in OAuth 2.1)

Security Controls

Control	NIST 800-53	Description
Access Control	AC-3	Token-based access enforcement
Authentication	IA-5	Client credential management
Session Management	SC-23	Token lifecycle management
Audit	AU-3	Log all token issuance and revocation
Cryptographic Protection	SC-13	PKCE and token signing

Common Pitfalls

Using implicit grant (removed in OAuth 2.1) instead of authorization code + PKCE
Storing tokens in localStorage (XSS vulnerable) instead of httpOnly cookies
Not validating state parameter enabling CSRF attacks
Using wildcard redirect URIs allowing open redirect exploitation
Not implementing refresh token rotation allowing token theft persistence

Verification

Authorization Code + PKCE flow completes successfully
PKCE code_challenge validated at token endpoint
State parameter prevents CSRF
Access tokens expire within configured lifetime
Refresh token rotation issues new refresh token each use
Token revocation invalidates both access and refresh tokens
Client Credentials flow works for service-to-service calls
Scopes correctly enforced at resource server

name	configuring-oauth2-authorization-flow
description	Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","authentication","authorization","oauth2","oidc","pkce"]
version	1.0
author	mahipal
license

name	configuring-oauth2-authorization-flow
description	Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","authentication","authorization","oauth2","oidc","pkce"]
version	1.0
author	mahipal
license

configuring-oauth2-authorization-flow

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

Configuring OAuth 2.0 Authorization Flow

Overview

When to Use

Prerequisites

Objectives

Key Concepts

OAuth 2.0 Grant Types

PKCE (Proof Key for Code Exchange)

Token Types

Workflow

Step 1: Authorization Code Flow with PKCE

Step 2: Scope Design

Step 3: Token Security

Step 4: Client Credentials Flow

Step 5: Security Hardening

Security Controls

Common Pitfalls

Verification