> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-oauth-labs/lab-3.md). # lab-3 ## OAuth Account Hijacking via redirect\_uri **Difficulty:** Practitioner ### Lab Description This lab uses an OAuth service to allow users to log in with their social media account. A misconfiguration by the OAuth provider makes it possible for an attacker to steal authorization codes associated with other users' accounts. **Objective:** Steal an authorization code associated with the admin user, use it to access their account, and delete the user `carlos`. **Credentials:** `wiener:peter` ### Root Cause The authorization server fails to properly validate the `redirect_uri` parameter in requests sent by the client application via the user's browser. As a result, it sends the generated authorization code to an attacker-controlled URI without verification, enabling authorization code hijacking. Vulnerable workflow: ``` Attacker │ Creates OAuth Request redirect_uri=evil.com │ ▼ Victim │ Clicks Link ▼ OAuth Server │ Victim already logged in │ Issues ADMIN_CODE │ Redirects ▼ Attacker Server │ Gets ADMIN_CODE │ ▼ Sends /callback?code=ADMIN_CODE │ ▼ Client Application │ POST /token ▼ OAuth Server │ Identity = Admin ▼ Client Application │ Creates Admin Session ▼ Attacker ``` ### Exploitation 1. Enable Burp interception and start the login flow, completing it fully. 2. In Burp history, find and send the following request to Repeater: ``` GET /auth?client_id=xxxxx&redirect_uri=https://client-app.net/oauth-callback&response_type=code&scope=openid%20profile%20email ``` 3. Start your attack server (Burp Collaborator or your own server) and copy its URL. Replace the `redirect_uri` value with your attack server URL. 4. Build the exploit payload and deliver it to the victim via the exploit server: ```html ``` 5. Capture the authorization code sent to your attack server by the OAuth provider. 6. In Burp history, find the OAuth callback endpoint and send it to Repeater: ``` GET /oauth-callback?code=ORIGINAL_CODE HTTP/2 ``` 7. Replace the `code` value with the admin's stolen code and send. You are now logged in as admin. 8. Delete the user `carlos` to complete the lab. ### Lesson Learned The authorization server must validate the `redirect_uri` strictly against a pre-registered whitelist of genuine callback URIs. Only exact-match URIs that were registered during client registration should be accepted — any deviation must be rejected. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-oauth-labs/lab-3.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.