[addtool] OAUTHScan

[gwen001]

[link]https://github.com/PortSwigger/oauth-scan[/link] [tags]burpsuite,auth,openid[/tags] [short_descr]Burp Suite Extension useful to verify OAUTHv2 and OpenID security.[/short_descr] [long_descr]OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards.

The plugin looks for various OAUTHv2/OpenID vulnerabilities and common misconfigurations. Below a non-exhaustive list of checks performed by OAUTHScan:

• Open Redirect issues on Redirect_Uri parameter
• Authorization Code Replay issues
• Leakage of secrets (i.e. Tokens, Codes)
• PKCE misconfigurations
• Nonce parameter misconfigurations
• State parameter misconfiguration
• Input Validation issues on Scope parameter
• Detection of inherently insecure Flows
• SSRF issues via Request_Uri parameter
• Detection of Well-Known and WebFinger resources
• And others...[/long_descr] [image]https://raw.githubusercontent.com/gwen001/offsectools_www/main/99dbb58e20495e1b4d35731b6348f056.png[/image]

[gwen001]

Issue correctly handled, tool is waiting for human validation.

[gwen001]

Tool has been accepted by the team: https://offsec.tools/tool/oauthscan

Thank you for your contribution!