okta-attack

## When to use this skill Trigger when: - DNS shows `<tenant>.okta.com` or `<tenant>.okta-emea.com` (EMEA region) - Login flow redirects to `<tenant>.okta.com/login` or `/app/<app_id>/sso/saml` - Web pages reference `/signin/customize`, `oktapreview.com`, or `auth-js-sdk` - Recon notes "uses Okta for SSO" - A target has `*.okta.com` SAN in TLS cert - Identity-fabric mapping returns Okta as IdP for a corporate app DO NOT use for: - Entra ID (use `m365-entra-attack` instead) - Google Workspace (use `google-workspace-attack` — not yet built) - ADFS (different protocol, on-prem) --- ## Tenant discovery ### Direct guesses ```bash # Tenant subdomains often match the brand # Replace these with your target's actual tenant slug candidates: for tenant in target-brand target-brand-ltd target-sister-brand target-brand-short target-other-variant; do for region in okta okta-emea oktapreview; do host="$tenant.$region.com" code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 8 "https://$host/") [ "$code" != "404" ] && [ "$code" != "000" ] && echo " $host $code" done done ``` ### Cross-ref from DNS ```bash # Look for CNAME records pointing to Okta # Replace with your target's actual domains: for domain in client.example client-ltd.example; do dig +short "sso.$domain" CNAME dig +short "login.$domain" CNAME dig +short "auth.$domain" CNAME dig +short "okta.$domain" CNAME done ``` ### Cross-ref from app HTTP flow ```bash # Visit corporate-app login, follow re...