OSBT: OpenID Connect Scenario-Based Tester
summary
A new test tool called OSBT encodes OpenID Connect attack scenarios as executable scripts, automates browser steps with Playwright, and modifies requests via an extended mitmproxy while logging exfiltration to Pipedream RequestBin. It reproduces two concrete implementation bugs—a direct-redirect bypass and a redirect-URI session poisoning—successfully stealing authorization codes and exchanging them for tokens. Tests run in CI via GitHub Actions, producing repeatable reports and covering both spec-based and implementation-specific flaws.
AI-written summary · about
chapters (19)
- 0:00OSBT introduction
- 1:06Social login and OpenID Connect
- 5:26OpenID Connect testing challenges
- 8:35OpenID Connect vulnerabilities
- 10:24Customizable test scenarios
- 12:14Limitations of existing tools
- 13:19How OSBT solves challenges
- 14:43Test scenario requirements
- 15:25Browser operation features
- 16:31HTTP manipulation features
- 17:13Malicious IdP features
- 19:00OSBT architecture
- 21:29Demo: URI bypass vulnerability
- 25:06Demo: OSBT bypass test
- 26:37Demo: Session poisoning vulnerability
- 30:24Demo: OSBT poisoning test
- 31:58GitHub Actions integration
- 34:13Summary and future
- 34:57Q&A
related talks
53mOAuth2/OIDC security weaknesses and pitfalls
21mVetting Single Sign-On SDK Implementations via Symbolic Reasoning
23mSecure by Design: Rethinking Test Credentials for Synthetic Monitoring
01h 00mWriting Security unit integration Tests using the OWASP O2 Platform
55mAutomating Security Testing with the OWTF
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
40mThe Attacker’s Guide to SSO and Passwordless Technologies
24mIoT Security Testing Guide (ISTG)