How do I install the Web OAUTH skill?

Run npx skillmds@latest add noorqureshi/web-oauth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web OAUTH safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web OAUTH?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web OAUTH free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web OAUTH?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web OAUTH by noorqureshi — Agent Skill

Name: Web OAUTH
Author: NoorQureshi

Web OAUTH

Attack OAuth 2.0 / OIDC / SSO flows for account takeover. Load on "Login with Google/GitHub", /authorize, /callback, redirect_uri, state, code/token params, SAML/OIDC SSO. Signals: OAuth endpoints, redirect_uri handling, missing state, implicit flow, pre-account-linking.

NoorQureshi 43584ba 2.0 KB Updated Sep 17, 2026

File contents

OAuth / OIDC / SSO abuse

When it applies

The app delegates auth via OAuth/OIDC (social login, enterprise SSO). Flaws here are frequently full account takeover.

Why it works

OAuth security depends on strict validation of redirect_uri, state, code binding, and how identities are linked. Implementations relax one of these — and the token/code that proves identity leaks to the attacker or an account gets linked to the wrong user.

Method

redirect_uri validation: try appended paths, //evil, @, subdomain/suffix tricks, open-redirect on an allowed host (→ web-open-redirect) to exfiltrate the code/token.
state / CSRF: missing or unvalidated state → login CSRF / force-link the victim to your account.
Account linking / pre-takeover: sign up with the victim's email pre-verification, or link a social account to an existing local account by email without proof → ATO.
Token/flow issues: implicit-flow token in URL/referrer leak; code reuse/no PKCE; ID-token email_verified trust; audience/issuer not checked; mixing providers.
Steal & replay: capture leaked code/token, complete the flow as the victim.

Gotchas

Most impact rides on a redirect_uri weakness or open redirect on an allowlisted host — chase that first.
"email_verified: false" trusted by the app is a classic pre-account-takeover.
Keep it your own test accounts; prove ATO against an account you control on both sides.

Verify success

You authenticate as (or link/hijack) a victim account — e.g. captured code completes login as the victim, demonstrated with two accounts you own.

References

PortSwigger OAuth labs; RFC 6749/6819; "OAuth security" (Salt/PortSwigger write-ups).

---name: web-oauthdescription: Attack OAuth 2.0 / OIDC / SSO flows for account takeover. Load on "Login with Google/GitHub", /authorize, /callback, redirect_uri, state, code/token params, SAML/OIDC SSO. Signals: OAuth endpoints, redirect_uri handling, missing state, implicit flow, pre-account-linking.---# OAuth / OIDC / SSO abuse## When it appliesThe app delegates auth via OAuth/OIDC (social login, enterprise SSO). Flaws here are frequentlyfull account takeover.## Why it worksOAuth security depends on strict validation of `redirect_uri`, `state`, `code` binding, and howidentities are linked. Implementations relax one of these — and the token/code that provesidentity leaks to the attacker or an account gets linked to the wrong user.## Method1. **redirect_uri validation**: try appended paths, `//evil`, `@`, subdomain/suffix tricks, open-redirect on an allowed host (→ `web-open-redirect`) to exfiltrate the `code`/`token`.2. **state / CSRF**: missing or unvalidated `state` → login CSRF / force-link the victim to your account.3. **Account linking / pre-takeover**: sign up with the victim's email pre-verification, or link a social account to an existing local account by email without proof → ATO.4. **Token/flow issues**: implicit-flow token in URL/referrer leak; `code` reuse/no PKCE; ID-token `email_verified` trust; audience/issuer not checked; mixing providers.5. **Steal & replay**: capture leaked `code`/`token`, complete the flow as the victim.## Gotchas- Most impact rides on a `redirect_uri` weakness or open redirect on an allowlisted host — chase that first.- "email_verified: false" trusted by the app is a classic pre-account-takeover.- Keep it your own test accounts; prove ATO against an account you control on both sides.## Verify successYou authenticate as (or link/hijack) a victim account — e.g. captured code completes login asthe victim, demonstrated with two accounts you own.## ReferencesPortSwigger OAuth labs; RFC 6749/6819; "OAuth security" (Salt/PortSwigger write-ups).

Frequently asked questions