hunt-oauth

## Crown Jewel Targets OAuth vulnerabilities are among the highest-value bug classes in web security because they directly enable **account takeover, session theft, and authentication bypass** — the trifecta that programs pay most for. **Highest-value targets:** - **Consumer identity providers** (Google, Facebook, PayPal, Apple SSO integrations) — any compromise cascades across all relying parties - **Mobile apps with custom deep link OAuth handlers** — Android/iOS intent handling is notoriously loose - **Multi-tenant SaaS platforms** (GitLab, Reddit-scale apps) where one OAuth flaw hits millions of accounts - **Gaming/entertainment platforms** with federated login (Rockstar, Oculus) — often security-immature teams - **Enterprise SSO connectors** — critical infrastructure, high severity payouts **Asset types that pay most:** - OAuth authorization endpoints (`/oauth/authorize`, `/connect/authorize`) - Token exchange endpoints (`/oauth/token`) - Mobile deep link handlers (`push_notification_webview`, custom scheme URIs) - Social login callback handlers (`/auth/callback`, `/oauth/callback`) **Typical payouts:** $500–$20,000+ depending on program; account takeover findings often hit max bounty. --- ## Attack Surface Signals ### URL Patterns to Hunt ``` /oauth/authorize /oauth/token /connect/authorize /auth/callback /oauth/callback /login?redirect_uri= /signin?next= /auth?return_to= /oauth/redirect /push_notification_webview ``` ### Response Headers That Signal OAuth ``` L...