oauth-hunter

OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection + assertion replay, OIDC ID token validation gaps, code/token leak channels, cross-tenant impersonation, PKCE downgrade, and any flow involving a code, access_token, id_token, assertion, client_id, client_secret, code_verifier, code_challenge, kid, or jku parameter.

h-mmer/pentest-agents1 installsSynced Aug 26

Works with

Claude CodeCursorCodex CLIGitHub CopilotGemini CLI

This skill's source license couldn't be confirmed as safe to mirror here, so it isn't inlined. View the full skill directly on its source repository.

View on GitHub

More DevOps & Infrastructure skills

← All DevOps & Infrastructure skills

Check your AI visibility

One URL in, a 0–100 score and the exact fixes out.

RUN THE CHECK

Browse all the tools

15 tools across six categories
13 of them never send your data anywhere

Free · No signup · No trial clock

SEE THE DIRECTORY