Oauth
bb-huge 🤗 , Personal bug bounty findings hub and bug bounty orchestration for multiple agents
npx -y skills add ShulkwiSEC/bb-huge --skill oauthAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
SKILL.md
4.0 KB, as published. Nobody here has run it
OAuth Authentication — Deep Dive
Deep-Dive Lab Playbook — Every PortSwigger lab variant with exact payloads, bypass techniques, and zero-day extensions. 🟢 Apprentice 🟡 Practitioner 🔴 Expert
When to Use
- BSCP certification prep
- Real-world bug bounty hunting
- Building exploitation chains
- Understanding bypass techniques
Prerequisites
- Burp Suite Professional
- Burp Collaborator / interactsh
- Browser with proxy configured
Workflow
Phase 1: Reconnaissance
- Identify input vectors, parameters, and application behavior.
Phase 2: Exploitation
- Apply standard lab payloads.
Phase 3: Zero-Day Escalation
- Fuzz filters, bypass WAFs, and chain with other vulns.
Lab Playbooks
Lab 1: Implicit flow bypass 🟡 PRACTITIONER
Intercept token response, change email/sub to victim's → authenticate as victim.
Lab 2: SSRF via OpenID registration 🟡 PRACTITIONER
Register OAuth client with logo_uri pointing to metadata endpoint: http://169.254.169.254/...
Lab 3: Forced profile linking 🟡 PRACTITIONER
Missing state parameter → CSRF attach your OAuth to victim's account.
Lab 4: Account hijack via redirect_uri 🟡 PRACTITIONER
redirect_uri=https://EXPLOIT-SERVER
Steal OAuth code, exchange for victim's access token.
Lab 5: Token theft via open redirect 🟡 PRACTITIONER
redirect_uri=https://TARGET/oauth-callback/../post/next?path=https://EXPLOIT-SERVER/
Chain open redirect to steal implicit flow tokens via Referer.
Lab 6: Token theft via proxy page 🔴 EXPERT
Find page that sends Referer with token to attacker-controllable iframe source.
Blue Team Detection
- Monitor access logs for anomalous payloads.
- Implement strict input validation and parameterized queries where applicable.
- Create WAF rules masking generic attack patterns.
Zero-Day Research
When standard technique fails:
- Identify the filter/WAF
- Fuzz with Burp Intruder custom wordlists
- Search GitHub/Twitter for new bypasses
- Chain with other vulns for escalation
- Try encoding variants: URL, double-URL, unicode, hex
Key Concepts
| Concept | Description |
|---|---|
| PortSwigger Vectors | Standardized approaches to vulnerability classes. |
| Payload Encoding | Modifying payloads to bypass basic string matching WAFs. |
Output Format
Vulnerability Deep-Dive Report
==============================
Target Vector: [Endpoint]
Bypass Technique: [Explanation of bypass]
Payload Used: [Payload]
Impact Explanation: [Impact]
🔵 Blue Team
- Deploy robust WAF rules to detect anomalies.
- Monitor logs for unusual access patterns.
🛡️ Remediation & Mitigation Strategy
- Input Validation: Sanitize and strictly type-check all inputs.
- Least Privilege: Constrain component execution bounds.
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class