Portswigger
  • Portswigger
  • Server-Side Request Forgery
    • Server-Side Request Forgery (SSRF)
  • SSRF with filter bypass via open redirection vulnerability
  • Blind SSRF with out-of-band detection
  • Cross-Site Scripting
    • Cross-Site Scripting (XSS)
  • Reflected XSS into a JS string with angle brackets and double&single quotes HTML-encoded escape
  • XSS into a template literal w/ angle brackets, single, double quotes, backslash & backticks Escaped
  • Authentication
    • Authentication
  • Username enumeration via subtly different responses
  • 2FA broken logic
  • Username enumeration via response timing
  • Username enumeration via account lock
  • Password reset poisoning via middleware
  • Path Traversal
    • Path Traversal
  • File path traversal, traversal sequences stripped with superfluous URL-decode
  • File path traversal, traversal sequences blocked with absolute path bypass
  • Business Logic Vulnerabilities
    • Business Logic Vulnerabilities
  • Insufficient workflow validation
  • Inconsistent handling of exceptional input
  • Server-Side Template Injection
    • Server-Side Template Injection
  • Basic server-side template injection
  • Basic server-side template injection (code context)
  • SQL Injection
    • SQL Injection
    • Blind SQL injection with conditional responses
  • SQL injection UNION attack, retrieving data from other tables
  • SQL injection attack, listing the database contents on non-Oracle databases
  • API Testing
    • API Testing
  • Exploiting an API endpoint using documentation
  • Exploiting a mass assignment vulnerability
  • Finding and exploiting an unused API endpoint
  • JWT ATTACK
    • JWT Attack
    • JWT authentication bypass via unverified signature
  • JWT authentication bypass via jku header injection
  • JWT authentication bypass via flawed signature verification
  • HTTP HOST HEADER ATTACKS
    • HTTP Host header attacks
  • Basic password reset poisoning
  • Host header authentication bypass
  • No SQL Injection
    • NoSQL Injection
  • Detecting NoSQL injection
  • Exploiting NoSQL operator injection to bypass authentication
  • Exploiting NoSQL injection to extract data
  • FILE UPLOAD VULNERABILITIES
    • File Upload Vulnerabilities
  • Web shell upload via obfuscated file extension
  • OAuth Authentication
    • OAuth Authentication
  • OAuth account hijacking via redirect_uri
  • ACCESS CONTROL VULNERABILITIES
    • Access Control Vulnerabilities
  • User ID controlled by request parameter with data leakage in redirect
  • User ID controlled by request parameter with password disclosure
  • User role controlled by request parameter
  • User role can be modified in user profile
  • URL-based access control can be circumvented
  • INFORMATION DISCLOSURE VULNERABILITIES
    • Information Disclosure Vulnerabilities
  • Information disclosure in version control history
  • XML external entity injection
    • XML External Entity (XXE) Injection
  • Exploiting XXE using external entities to retrieve files
  • Exploiting blind XXE to retrieve data via error messages
  • Blind XXE with out-of-band interaction
  • Blind XXE with out-of-band interaction via XML parameter entities
  • OS COMMAND INJECTION
    • OS Command Injection
  • Blind OS command injection with out-of-band data exfiltration
  • PROTOTYPE POLLUTION
    • Prototype Pollution
  • Privilege escalation via server-side prototype pollution
  • WEB CACHE POISONING
    • Web Cache Poisoning
  • Web cache poisoning via an unkeyed query parameter
Powered by GitBook
On this page

OAuth account hijacking via redirect_uri

Link: https://portswigger.net/web-security/oauth/lab-oauth-account-hijacking-via-redirect-uri

PreviousOAuth AuthenticationNextAccess Control Vulnerabilities

Last updated 3 months ago

Description:

This lab uses an service to allow users to log in with their social media account. A misconfiguration by the OAuth provider makes it possible for an attacker to steal authorization codes associated with other users' accounts.

To solve the lab, steal an authorization code associated with the admin user, then use it to access their account and delete the user carlos.

The admin user will open anything you send from the exploit server and they always have an active session with the OAuth service.

You can log in with your own social media account using the following credentials: wiener:peter.

Preparation:

  • Install Cookie-Editor extension browser

Proof of concept:

  1. Analisa web target menggunakan akun testing

  2. Terlihat pada proses OAuth authentication menggunakan 2 endpoint yaitu endpoint /auth dan /oauth-callback . Yang dimana pada endpoint /auth terdapat parameter redirect_uri yang digunakan untuk mengarahkan pengguna ke endpoint /oauth-callback . Sedangkan endpoint /oauth-callback tersebut digunakan untuk menggenarate code melalui parameter code yang digunakan untuk membuat session

  3. Dari hasil analisa, didapati bahwa pada endpoint /auth nilai pada parameter redirect_uri dapat diubah. Sebagai contoh disini nilai pada parameter tersebut diubah menjadi domain attacker, dan berhasil diubah dengan ditandai pada response diarahkan ke domain target

  4. Setelah diketahui bahwa nilai parameter redirect_uripada endpoint /auth dapat diubah. Buat script iframe untuk mengelabui korban agar korban mengakses script malicious tersebut yang diarahkan ke domain target untuk mengambil code pada endpoint /oauth-callback di domain penyerang. Script iframe yang digunakan terlihat seperti gambar dibawah ini

  5. Jika sudah kirim script tersebut agar diakses korban. Jika korban telah mengaksesnya, maka penyerang akan mendapatkan code pada endpoint /oauth-callback

  6. Hit endpoint /oauth-callback pada domain web target (domain asli) untuk mendapatkan session

  7. Setelah mendapatkan session yang diambil dari response yang diberikan pada request sebelumnya, copy nilai session tersebut kemudian buka ekstension browser Cookie-Editor pada halaman target. Ubah nilai session dari akun testing, menjadi nilai session milik akun korban. Jika sudah, simpan perubahan tersebut

  8. Lakukan refresh pada halaman target, dan terlihat akun telah berubah menjadi akun admin ditandai dengan adanya halaman Admin panel

  9. Untuk menyelesaikan tantangan pada lab ini, lakukan penghapusan user carlos

Thanks, Stay Ethical & Happy Hacking! 🍻

OAuth