<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-oauth-security-testing
description: >-
  Test OAuth 2.0 and OpenID Connect implementations for authorization
  code interception, CSRF via missing state parameter, open redirect
  in redirect_uri, token leakage, scope escalation, and PKCE bypass
  vulnerabilities.
domain: cybersecurity
subdomain: application-security
tags:
  - oauth
  - oidc
  - authorization
  - token-theft
  - owasp-a07
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1550.001", "T1528"]
  owasp-top10: ["A07"]
  tools: ["burpsuite", "curl", "nuclei"]
---

# Performing OAuth Security Testing

## Overview

OAuth 2.0 misconfigurations allow authorization code interception, account
takeover via redirect_uri manipulation, token leakage through referrer
headers, CSRF attacks from missing state validation, and scope escalation.
Testing validates the full authorization flow including PKCE enforcement.

## Prerequisites

- Tools: Burp Suite, curl, nuclei
- OAuth client credentials (client_id, redirect_uri)
- Test accounts on the identity provider

## Workflow

### Step 1: Map OAuth Endpoints

```bash
# Discover OpenID configuration
curl -s https://target.com/.well-known/openid-configuration | jq .

# Discover OAuth metadata
curl -s https://target.com/.well-known/oauth-authorization-server | jq .
```

### Step 2: Test redirect_uri Validation

```bash
# Open redirect via path traversal
curl -s -D- "https://target.com/oauth/authorize?\
client_id=CLIENT_ID&response_type=code&\
redirect_uri=https://app.com/callback/../../../evil.com"

# Subdomain bypass
curl -s -D- "https://target.com/oauth/authorize?\
client_id=CLIENT_ID&response_type=code&\
redirect_uri=https://evil.app.com/callback"

# URL encoding bypass
curl -s -D- "https://target.com/oauth/authorize?\
client_id=CLIENT_ID&response_type=code&\
redirect_uri=https://app.com%40evil.com/callback"
```

### Step 3: Test State Parameter and CSRF

```bash
# Authorization without state (should be rejected)
curl -s -D- "https://target.com/oauth/authorize?\
client_id=CLIENT_ID&response_type=code&\
redirect_uri=https://app.com/callback&scope=openid"

# Replay captured authorization code
curl -s -X POST https://target.com/oauth/token \
  -d "grant_type=authorization_code&code=CAPTURED_CODE&\
client_id=CLIENT_ID&redirect_uri=https://app.com/callback"
```

### Step 4: Test Token Security

```bash
# Test scope escalation
curl -s -X POST https://target.com/oauth/token \
  -d "grant_type=refresh_token&refresh_token=TOKEN&\
client_id=CLIENT_ID&scope=admin openid profile"

# Test token revocation
curl -s -X POST https://target.com/oauth/revoke \
  -d "token=ACCESS_TOKEN&client_id=CLIENT_ID"

# Verify revoked token is rejected
curl -s -H "Authorization: Bearer REVOKED_TOKEN" \
  https://target.com/api/user
```

### Step 5: PKCE Verification

```bash
# Authorization without code_challenge (should fail if PKCE required)
curl -s -D- "https://target.com/oauth/authorize?\
client_id=CLIENT_ID&response_type=code&\
redirect_uri=https://app.com/callback&scope=openid"

# Token exchange without code_verifier
curl -s -X POST https://target.com/oauth/token \
  -d "grant_type=authorization_code&code=AUTH_CODE&\
client_id=CLIENT_ID&redirect_uri=https://app.com/callback"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| redirect_uri mismatch | OAuth server logs | Callback URL differs from registered |
| Missing state parameter | Application logs | Authorization requests without state |
| Code reuse attempt | Token endpoint logs | Same authorization code used twice |

```yaml
title: Oauth Security Testing Detection
id: 9fd3b012-1897-48f5-ade8-ec1e4863443d
status: experimental
description: Detects suspicious activity related to performing oauth security testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1550.001
  - attack.t1528
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] redirect_uri strictly validated against whitelist
- [ ] State parameter required and validated
- [ ] PKCE enforced for public clients
- [ ] Authorization codes are single-use
- [ ] Token revocation properly invalidates tokens
- [ ] Implicit flow disabled or properly scoped

## References

- [OAuth 2.0 Security Best Practices (RFC 9700)](https://datatracker.ietf.org/doc/html/rfc9700)
- [PortSwigger OAuth Testing](https://portswigger.net/web-security/oauth)
- [OWASP OAuth Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/OAuth_Cheat_Sheet.html)
