# Hunt Oauth

Hunting skill for oauth vulnerabilities.

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill hunt-oauth -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill hunt-oauth -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill hunt-oauth -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill hunt-oauth -g -a gemini-cli -y`

## Description

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## Crown Jewel Targets

OAuth vulnerabilities are among the highest-value bug classes in web security because they directly enable **account takeover, session theft, and authentication bypass**, the trifecta that programs pay most for.

**Highest-value targets:**
- **Consumer identity providers** (Google, Facebook, PayPal, Apple SSO integrations), any compromise cascades across all relying parties
- **Mobile apps with custom deep link OAuth handlers**, Android/iOS intent handling is notoriously loose
- **Multi-tenant SaaS platforms** (GitLab, Reddit-scale apps) where one OAuth flaw hits millions of accounts
- **Gaming/entertainment platforms** with federated login (Rockstar, Oculus), often security-immature teams
- **Enterprise SSO connectors**, critical infrastructure, high severity payouts

**Asset types that pay most:**
- OAuth authorization endpoints (`/oauth/authorize`, `/connect/authorize`)
- Token exchange endpoints (`/oauth/token`)
- Mobile deep link handlers (`push_notification_webview`, custom scheme URIs)
- Social login callback handlers (`/auth/callback`, `/oauth/callback`)

**Typical payouts:** $500, $20,000+ depending on program; account takeover findings often hit max bounty.

---

## Attack Surface Signals

### URL Patterns to Hunt
```
/oauth/authorize
/oauth/token
/connect/authorize
/auth/callback
/oauth/callback
/login?redirect_uri=
/signin?next=
/auth?return_to=
/oauth/redirect
/push_notification_webview
```

### Response Headers That Signal OAuth
```
Location: https://accounts.example.com/oauth/...
Set-Cookie: oauth_state=
WWW-Authenticate: Bearer
Content-Type: application/json (with access_token in body)
```

### JavaScript Patterns (grep in JS bundles)
```javascript
redirect_uri
client_id
response_type=code
response_type=token
state=
nonce=
oauth_token
access_token
push_notification_webview
deeplink
intent://
```

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/Claude-BugHunter/skills/hunt-oauth/SKILL.md