Well-known / security.txt / OIDC discovery
/.well-known/openid-configuration, oauth-authorization-server, security.txt, change-password, apple-app-site-association, assetlinks.json, jwks.json.
Tags: recon, oauth, mobile
Typical severity: P5
What it becomes
Recon only, unless a key or an admin panel is sitting there.
Where to look
apex and www and auth. and login. and api.
Chains
- OAuth attacks — Discovery gives you the authorize / token / jwks URLs the SPA hid.
- Mobile deep links — AASA / assetlinks list the real app IDs and paths.
Notes
- The well-known copier on /utils/ is the checklist. Hit every host, not just www.