Notes
  • Welcome!
  • Windows Shells
    • Introduction
    • Command Prompt
      • Basics
      • Host Enumeration
      • Files & Directories
      • Environment Variables
      • Managing Services
      • Scheduled Tasks
      • Help
    • PowerShell
      • PowerShell vs. CMD
      • Basics
      • CmdLets & Modules
      • User & Group Management
      • Files & Dirs
      • Finding & Filtering
      • Services
      • Registry
      • Windows Event Log
      • Networking Management
      • Web Interaction
      • Scripting
      • Help
  • Windows
    • Commands
    • NTFS
  • APISEC
    • API Testing
      • Recon
      • Endpoint Analysis
      • Finding Security Misconfigurations
      • Authentication Attacks
      • Exploiting API Authorization
        • BOLA
        • BFLA
      • Improper Assets Management
      • Mass Assignment Attacks
      • SSRF
      • Injection Attacks
      • Evasion & Chaining
    • API Authentication
      • Authentication Types
      • OAuth Actors
      • OAuth Interaction Patterns
      • JSON Web Tokens
      • Claims
      • APIs & Gateways
  • PostSwigger
    • Web LLM Attacks
      • Overview
      • Exploiting LLM APIs, function, & Plugins
      • Indirect Prompt Injection
      • Leaking Sensitive Data
      • Defending Against LLM Attacks
    • JWT Attacks
      • JWTs
      • Attacks
        • Flawed Signature Verfication
        • Brute-forcing Secret Keys
        • JWT Header Parameter Injections
        • Algorithm Confusion
      • Prevention
    • OAuth
      • General Information
      • Exploiting OAuth Authentication Flaws
        • Flaws in Client Application
        • Flaws in the OAuth Service
      • OpenID
  • Red Teaming LLM Applications
    • LLM Vulnerabilities
    • Red Teaming LLMs
    • Red Teaming at Scale
    • Red Teaming LLMs with LLMs
    • Red Teaming Assessment
  • Fin
    • Course 1: Basics
      • Stocks
        • General Information
        • Shares
        • Stock Basics
      • Bonds
        • General Information
        • Components
        • Valuation
      • Markets
        • What is the Stock Market
        • What is the FED
    • Course 2: Stock Investing
  • Other
    • Learning Resources
Powered by GitBook
On this page
  • Implicit Grant Type
  • LAB: Authentication Bypass via OAuth Implicit Flow
  • Flawed CSRF protection
  • LAB: Forced OAuth Profile Linking
  1. PostSwigger
  2. OAuth
  3. Exploiting OAuth Authentication Flaws

Flaws in Client Application

PreviousExploiting OAuth Authentication FlawsNextFlaws in the OAuth Service

Last updated 11 months ago

Flaws in the client's application's implementation of OAuth.

Implicit Grant Type

  • The implicit grant type sends access tokens via the browser as a URL fragment.

  • If the app wants to maintain the session after the user closes the page, it needs to store the current user data, i.e., user ID and access token. It will often submit this data to the server in a POST request and then assign the user a session cookie.

  • The problem arises due to the fact that the server does not have any secrets/passwords to compare with the submitted data -> it is implicitly trusted. This request is exposed to attackers via their browser and can be leveraged for user impersonation.

LAB: Authentication Bypass via OAuth Implicit Flow

Goal: Log into the application as carlos.

The access token provided (Step 3) is not tied with a specific user. If we change the email address, which in this case is used as the user identification, we can authenticate as any other user (Step 5).

Flawed CSRF protection

  • The optional, but highly recommended, state parameter should contain the hash of something tied to the user's session when the OAuth flow is initiated.

  • If the authorization request does not contain the state parameter, it means that an attacker can potentially initiate an OAuth flow themselves before tricking a user's browser into completing it (similar to a classic CSRF attack).

LAB: Forced OAuth Profile Linking

Goal: Use a CSRF attack to attach your own social media profile to admin and delete carlos.

The authorization request has not state parameter and redirects to /oauth-linking. After copying the URL, we need to drop the request so the code will remain valid for use.

When the admin loads the iframe payload, it will complete the OAuth flow resulting in attaching their account to wiener's social media profile. Thus, when wiener's social profile is used to log into the application, the account will have elevated privileges.

Image taken from .
here