<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# OAuth Implementation Auditing — API Reference

## OIDC Discovery

```bash
# Fetch discovery document
curl -s https://auth.target.com/.well-known/openid-configuration | jq .

# Key fields to inspect
# - authorization_endpoint
# - token_endpoint
# - response_types_supported (should NOT include "token")
# - grant_types_supported (should NOT include "password")
# - code_challenge_methods_supported (should include "S256")
# - token_endpoint_auth_methods_supported
```

## Authorization Endpoint Testing

```bash
# Standard authorization code flow
curl -v "https://auth.target.com/authorize?\
client_id=CLIENT_ID&\
response_type=code&\
scope=openid+profile&\
redirect_uri=https://app.target.com/callback&\
state=$(openssl rand -hex 16)&\
code_challenge=CHALLENGE&\
code_challenge_method=S256"

# Test without state (CSRF)
# Test without PKCE (code interception)
# Test with modified redirect_uri (open redirect)
# Test with elevated scope (privilege escalation)
```

## Token Endpoint Testing

```bash
# Exchange authorization code
curl -s -X POST https://auth.target.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "client_id=CLIENT_ID" \
  -d "client_secret=CLIENT_SECRET" \
  -d "redirect_uri=https://app.target.com/callback" \
  -d "code_verifier=VERIFIER"

# Refresh token
curl -s -X POST https://auth.target.com/oauth/token \
  -d "grant_type=refresh_token" \
  -d "refresh_token=REFRESH_TOKEN" \
  -d "client_id=CLIENT_ID"

# Token introspection
curl -s -X POST https://auth.target.com/oauth/introspect \
  -u "CLIENT_ID:CLIENT_SECRET" \
  -d "token=ACCESS_TOKEN"

# Token revocation
curl -s -X POST https://auth.target.com/oauth/revoke \
  -u "CLIENT_ID:CLIENT_SECRET" \
  -d "token=REFRESH_TOKEN"
```

## Burp Suite Extensions

| Extension | Purpose |
|-----------|---------|
| OAuth Scan | Automated OAuth vulnerability detection |
| AuthMatrix | Authorization testing across roles |
| Autorize | Automated authorization enforcement testing |

## Key Checks

| Check | Method | Expected Result |
|-------|--------|-----------------|
| Redirect URI validation | Fuzz `redirect_uri` param | Exact match only |
| PKCE enforcement | Omit `code_verifier` | Token request rejected |
| State validation | Omit/replay `state` | Auth flow rejected |
| Code reuse | Replay auth code | Second exchange fails |
| Scope enforcement | Request admin scope | Denied or requires consent |
| Refresh rotation | Reuse old refresh token | All tokens revoked |
