OAUTH Misconfigurations
Brute Force to Get Legacy OR Unimplemented OAuth Flows
Modify hd= parameter
hd= parameterIn OAuth Connect With Google , Try To Modify hd Parameter From company.com To gmail.com To Be Able To Connect With Your Email
https://twitter.com/intigriti/status/1383397368691789825
Remove email from scope
email from scopeTry To Remove Your Email From Scope Parameter While Signing Up OR Signing In With Services Provider To Get Account Takeover
Use Access Token Of Your App Instead Of Auth Token Of Victim App
Change The Host Header
Insert Your Domain In Referer Header While
Insert admin@comapny.com in scope
In OAuth Connect Request , Try To Insert admin@company.com as Value Of Email In Scope Parameter To Gain Extra Authorities OR Get More Functionalities
IDOR in id= Parameter
id= ParameterIn OAuth Connect Request , Try To Recall Id In Scope Then Try To Change This Id To Id Of Logged In Account To Takeover This Account
Add JSON OR XML Extension To OAuth Endpoint
In OAuth Connect Request , Try To Add JSON OR XML Extension To OAuth Endpoint e.g. oauth/connect.json , Maybe Token Expose In Response !
XSS in OAUTH Connect/Callback
Insert XSS Payloads To Cause Errors
Try To Insert XSS Payloads e.g. XSS To Cause Errors
SSTI in Scope Parameter
In OAuth Connect Request Try To Insert SSTI Payloads In Scope Parameter e.g. ${T(java.lang.Runtime).getRuntime().exec("calc.exe")} To Get RCE
XSS in RedirectUri
Try To Insert XSS Payloads As Value Of Redirect URL e.g. data:company.com;text/html;charset=UTF-8,%3Chtml%3E%3Cscript%3Edocument.write(document.domain);%3C%2Fscript%3E%3Ciframe/src= xxxxx%3Eaaaa%3C/iframe%3E%3C%2Fhtml%3E To GET DOM-Based XSS
Path Traversal to open Redirect
Try To Insert Redirect URL Parameter To Redirect URL As Value To Steal The Authorization Code OR The Access Token
Authentication Bypass via OAuth Implicit Flow
Study OAuth flow starting from the authorization request
GET /auth?client_id=[...].Client receives user info from the OAuth service.
Client logs in by sending a POST request to its
/authenticateendpoint with user info and access token.In Burp Repeater, modify the email in the POST request to impersonate another user.
Right-click the POST request, select "Request in browser" > "In original session", visit the URL, and log in as another user.
Forced OAuth Profile Linking
Sign in with a social media profile.
Capture the request that includes
redirect_uriin/auth?client_id[...].Check if the
stateparameter is present. If not, it’s vulnerable to CSRF.Copy the request URL from Burp, drop the request, and turn off intercept.
Log out, send the link to the victim, or use an iframe on your website.
Victim's browser completes the OAuth flow, linking your profile to their account.
CSRF
Insufficient Redirect URI Validation
Exploits:
Open Redirect: Redirect sensitive data to an attacker-controlled server.
https://yourtweetreader.com/callback?redirectUrl=https://evil.comRedirec_uriBypasses
Path Traversal:
https://yourtweetreader.com/callback/../redirect?url=https://evil.comWeak Regexes:
https://yourtweetreader.com.evil.comHTML Injection:
https://app.victim.com/login?redirectUrl=https://app.victim.com/dashboard</script><h1>test</h1>XSS: Reflecting redirect URL in response.
Steps:
Identify the
redirect_uriparameter.Construct an exploit URL to steal the authorization code.
Use the stolen code to complete the OAuth flow.
SSRF via OpenID Dynamic Client Registration
Browse
/.well-known/openid-configurationto find the registration endpoint.Create a POST request to register a client.
Test if the
logo_uriparameter is vulnerable to SSRF.
Stealing OAuth Access Tokens via a Proxy Page
Register a client using a POST request.
Test
logo_urifor SSRF to read metadata files.
OAuth Account without email Address
Register account with phone number in 3rd party
use this account to register on target
in settings add victim email
Microsoft nOAuth Misconfiguration
Facebook OAuth Misconfiguration
Click Sign in with Facbook
Click "Edit Access"
Uncheck Email address
You loged in without email address
OAuth Code Flaws
Reuse of authorization codes.
Brute-force attacks on codes.
Validity of a code across different applications.
Access Token Scope Abuse
Use an access token to access elevated scope endpoints.
Pre-Account Takeover
Register an account with the victim's email and attacker’s password.
Victim uses OAuth to register, linking their account to the attacker’s credentials.
ALL ATTACKS WITH PROMPT=NONE TO MINIMISE INTERACTION
PROMPT=NONE TO MINIMISE INTERACTIONPlay With response_mode
response_mode The normal value to it is
&response_mode=queryBy Changing it's value to fragment the code is leaked in the url after
#character
Exploit XSS in the Authorization Server to steal Victim's code
Make
&response_mode=form_postand the response will be for that send's post request with code and state parameter
Attacker can steal the code and state parameter using this code
POST-AUTH REDIRECT + LOGIN CSRF
There is endpoint vulnerable to open redirect using it to bypass
redirect_uriRestrictions and using&response_mode=fragmentto send code in urlThe website is vulnerable to an open redirect. After a user logs in, we can exploit the
stateparameter to perform a CSRF attack, causing the user to log into our account after completing the OAuth process. However, to steal the user's session/code when they log into the attacker-owned account, we can use&response_mode=fragment. This will send the user's code to an attacker-controlled site in the URL after the#sign, along with the attacker's code in the query.
Disclosure of Secrets
Leaking
client_secretallows attackers to generate access tokens and access user data.
Client Secret Brute Force
Brute force the
client_secretto steal accounts.
Referrer Header Leaking Code + State
Verify if the code and state are reflected in the Referrer header when the user navigates to another page.
Access Token Stored in Browser History
Ensure access tokens are not stored in browser history.
Everlasting Authorization Code
Authorization code should have a short lifespan to limit the attack window.
Authorization/Refresh Token Not Bound to Client
Ensure tokens are bound to the specific client.
Refresh Token Issues
Race Conditions in OAuth 2 API Implementations
Verify for potential race conditions that can lead to security issues.
Summary
OAuth implementations can be vulnerable to various security issues. By understanding these vulnerabilities and following the steps outlined, you can effectively test and secure OAuth flows.
References
List Of Patterns To Bypass The Whitelist In Redirect URL Parameter
Use IDN Homograph Attack To Spoof Redirect URL Parameter
Try To Use IDN Homograph Attack To Spoof Redirect URL Parameter To Steal The Authorization Code OR The Access Token
Black Characters
Try To Insert Invisible Range %00 To %FF in The URL e.g. me.com%5bcompany.com As Value Of Redirect URL Parameter
Change Request Method
Try To Change Request Method To e.g. GET , POST , HEAD OR PUT To Understand How Company Routes The Different Methods in OAuth Flow
Race Condition
Try To Figure Out Reaction Of The Server While Doing Race Condition By Using Turbo Intruder OR Nuclei To Send Simultaneously Requests
XSS in the code= parameter
code= parameterTry To Insert XSS Payloads e.g. ,%2520alert(123))%253B// In The Authorization Code Parameter If Value Of Code Parameter Reflected
Reuse The Authorization Code With XSS Payloads
If The Authorization Code Is Used More Than Once Try To Reuse The Authorization Code With XSS Payloads e.g. Codealert('XSS')
Use The OAuth Token With Logged In User In OAuth Provider
*** If App Ask You Log In With OAuth Provider By Generating OAuth Token , Try To Use The OAuth Token With Logged In User In OAuth Provider
Exploit Post Messages
Try To Use Whitelist Subdomain With Endpoint Contains postMessage(Msg,"*"); In which Msg = window.location.href.split("#")[1]; To Steal The Access Token
Last updated
