Individual skill
okta-attack
Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use when recon shows `<tenant>.okta.com`, `<tenant>.okta-emea.com`, `<tenant>.oktapreview.com`, or autodiscover-style records pointing at Okta IdP.
skills/okta-attack/SKILL.md
Source commit d67cc00d9297a15b9210121e0a93c33f9fb6be46
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 5,492
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-security Repository topic
- anthropic Repository topic
- application-security Repository topic
- bug-bounty Repository topic
- bugbounty Repository topic
- bugcrowd Repository topic
- claude Repository topic
- claude-code Repository topic
- claude-skills Repository topic
- ethical-hacking Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytesSKILL.mdcore · 24,192 bytes
Read excerpt
## When to use this skill
Trigger when:
- DNS shows `<tenant>.okta.com` or `<tenant>.okta-emea.com` (EMEA region)
- Login flow redirects to `<tenant>.okta.com/login` or `/app/<app_id>/sso/saml`
- Web pages reference `/signin/customize`, `oktapreview.com`, or `auth-js-sdk`
- Recon notes "uses Okta for SSO"
- A target has `*.okta.com` SAN in TLS cert
- Identity-fabric mapping returns Okta as IdP for a corporate app
DO NOT use for:
- Entra ID (use `m365-entra-attack` instead)
- Google Workspace (use `google-workspace-attack` — not yet built)
- ADFS (different protocol, on-prem)