Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
OAuth
OAuth misconfigurations leak authorization codes and tokens — redirect_uri validation is where most of the bugs live. Broken OAuth isn't one bug: it's redirect flaws, missing state, replay, and trust misplaced in the frontend.
Severity guide
Critical when codes/tokens reach attacker control (account takeover); high for pre-ATO/account-linking abuse; the chain is always the story.
Where to look
entry points to test first01
redirect_uri parameter
Every flow has one — test validation: exact match? prefix? subdomain? none?
02
state parameter
Remove it, tamper it, reuse it — CSRF binding for the whole flow.
03
Authorization codes
Single-use enforcement, expiry, and audience binding — replay across clients/flows.
04
implicit flows
response_type=token puts access tokens in URL fragments — any leak is instant ATO.
05
Account linking features
'Connect X to Y' flows — pre-ATO lives in trusting the identity assertion.
How to hunt it
in order, start to finishMap the flow first
Walk the full OAuth dance with your own account. Note every redirect_uri, state, and where the code/token appears.
Attack redirect_uri
Lax validation: evil.com (exact match missing), subdomains, path prefixes, nested next= params, open-redirect chains back into the app.
Check state (CSRF)
Remove/break the state param. If the flow still completes, an attacker can bind their session to a victim's account.
Replay and reuse
Re-submit an already-used code, or use a code issued to your account against a victim flow — servers that accept them enable pre-ATO.
Test the client side too
PKCE missing on public clients, tokens in fragments reachable by CSS/XSS, and frontend-trusted user data (email change without re-verification) complete the takeover.
Filter & validation bypasses
when your first tries get blocked- 01redirect_uri validated? Subdomain takeover on an allowed domain, path traversal (/../), or open redirects on allowed hosts chain out.
- 02state enforced? Look for client-side validation only — the state check must be server-side to matter.
- 03Code single-use? Replay across different redirect_uris or client_ids — some servers scope the check narrowly.
- 04PKCE present? Downgrade attacks: omit code_verifier on retry, or find flows where PKCE wasn't wired through.
Impact ladder
what makes it payable- 01Full account takeover — stolen codes/tokens exchanged for sessions.
- 02Pre-ATO — bind your identity to a victim's account via flow-CSRF.
- 03Persistent access — refresh tokens outlive password changes on weak revocation.
- 04Cross-app data theft — authorized scopes granted to attacker-controlled clients.
Payloads
5 · from PayloadsAllTheThings&redirect_uri=https://localhost.evil.comSubdomain trick — ends with the app's allowed string, resolves to attacker host.
&redirect_uri=https://accounts.google.com/BackToAuthSubTarget?next=https://evil.comNested redirect — trusted domain chains to attacker via its own open redirect.
&redirect_uri=https%3A%2F%2Fapps.facebook.com%2Fattacker%2FDouble-encoded URI — validation on decoded, routing on encoded (or vice versa).
&redirect_uri=data%3Atext%2Fhtml%2Ca&state=<script>alert('XSS')</script>data: URI + XSS in state — the full abuse spectrum in one request.
&response_type=tokenImplicit-flow downgrade — tokens in fragments where code+PKCE should be.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.