<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-oauth-implementations
description: >-
  Audit OAuth 2.0 and OpenID Connect implementations for authorization code
  interception, redirect URI manipulation, scope escalation, PKCE bypass,
  token leakage, and client credential exposure.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - oauth2
  - oidc
  - authorization
  - redirect-uri
  - pkce
  - token-theft
  - burp-suite
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1550.001"]
---

# Auditing OAuth Implementations

## Overview

OAuth 2.0 and OpenID Connect (OIDC) are complex protocols where implementation
errors create severe authorization bypasses. Common flaws include open redirect
via lax `redirect_uri` validation, missing PKCE in public clients, authorization
code replay, scope escalation, token leakage through referrer headers, and
insecure `state` parameter handling enabling CSRF attacks.

Mode: `[MODE: RED]` for OAuth exploitation; `[MODE: BLUE]` for implementation hardening.

MITRE ATT&CK: T1528 (Steal Application Access Token), T1550.001 (Application Access Token)

## Prerequisites

- Burp Suite Professional with OAuth/OIDC extensions
- Browser with developer tools (Network tab)
- `curl` or `httpie` for manual token endpoint testing
- Python 3.10+ with `requests`, `oauthlib`
- Target application OAuth client credentials (for authorized testing)

## Key Concepts

### OAuth Attack Surface

| Attack | Vector | Severity |
|--------|--------|----------|
| Open Redirect | Lax `redirect_uri` validation | Critical |
| Auth Code Interception | Missing PKCE on public client | High |
| Scope Escalation | Request elevated scopes post-consent | High |
| Token Leakage | Token in URL fragment or referrer header | High |
| CSRF via State | Missing/predictable `state` parameter | Medium |
| Client Secret Exposure | Hardcoded secrets in client-side code | Critical |
| Device Code Phishing | Social engineering via device auth flow | High |
| Token Replay | Reuse of access/refresh tokens | Medium |

### Redirect URI Bypass Techniques

```bash
# Exact match bypass attempts
https://target.com/callback@evil.com
https://target.com/callback/../evil
https://target.com/callback%2f..%2f..%2fevil
https://evil.com#@target.com/callback
https://target.com/callback?next=https://evil.com
https://target.com/callback/.evil.com
https://target.com/callback\@evil.com

# Subdomain bypass
https://evil.target.com/callback
https://target.com.evil.com/callback

# Path traversal
https://target.com/callback/../open-redirect?url=https://evil.com
```

### PKCE Verification

```bash
# Check if PKCE is required for public clients
curl -s -X POST https://auth.target.com/oauth/token \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "client_id=CLIENT_ID" \
  -d "redirect_uri=https://target.com/callback"
  # If token returned without code_verifier → PKCE not enforced

# Proper PKCE flow
CODE_VERIFIER=$(openssl rand -base64 32 | tr -d '=/+' | head -c 43)
CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d '=' | tr '/+' '_-')
```

## Workflow

### Step 1: Map OAuth Endpoints

```bash
# Discover OIDC configuration
curl -s https://auth.target.com/.well-known/openid-configuration | jq .

# Key endpoints to test
# - authorization_endpoint
# - token_endpoint
# - userinfo_endpoint
# - revocation_endpoint
# - jwks_uri
```

### Step 2: Test Redirect URI Validation

```bash
# Automated redirect_uri fuzzing
node scripts/agent.js \
  --auth-endpoint https://auth.target.com/authorize \
  --client-id CLIENT_ID \
  --redirect-uri https://target.com/callback \
  --output /tmp/oauth_findings.json
```

### Step 3: Test Token Security

```bash
# Check token in URL fragment (implicit flow)
# Inspect browser history and referrer headers for token leakage

# Test refresh token rotation
curl -s -X POST https://auth.target.com/oauth/token \
  -d "grant_type=refresh_token" \
  -d "refresh_token=REFRESH_TOKEN" \
  -d "client_id=CLIENT_ID" | jq .

# Replay old refresh token (should fail if rotation enforced)
```

### Step 4: Validate Scope Enforcement

```bash
# Request elevated scopes
curl -s "https://auth.target.com/authorize?\
client_id=CLIENT_ID&\
response_type=code&\
scope=openid+profile+email+admin+write:all&\
redirect_uri=https://target.com/callback&\
state=$(openssl rand -hex 16)"
```

## Detection

```yaml
title: Auditing Oauth Implementations Detection
id: 77ace448-ecde-44a2-aa80-7ae15aca30d0
status: experimental
description: Detects suspicious activity related to auditing oauth implementations techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1550.001
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] `redirect_uri` validated with exact string match (no pattern/wildcard)
- [ ] PKCE required for all public clients (SPA, mobile)
- [ ] `state` parameter required, cryptographically random, and validated
- [ ] Implicit flow (`response_type=token`) disabled
- [ ] Authorization codes single-use with short expiry (<60 seconds)
- [ ] Refresh token rotation enabled with reuse detection
- [ ] Client secrets not exposed in client-side code or version control
- [ ] Token lifetime follows least-privilege (access: 15 min, refresh: 8 hours)

## References

- [OWASP OAuth 2.0 Security Testing](https://owasp.org/www-project-web-security-testing-guide/)
- [RFC 6749 — OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749)
- [RFC 7636 — PKCE](https://datatracker.ietf.org/doc/html/rfc7636)
- [PortSwigger — OAuth 2.0 Authentication Vulnerabilities](https://portswigger.net/web-security/oauth)
- [MITRE ATT&CK T1528](https://attack.mitre.org/techniques/T1528/)
