oauth-flow-exploitation

OAuth 2.0 Flow Exploitation

When to Use

• When evaluating Single Sign-On (SSO) integrations that allow users to register or log into the application using a third-party Identity Provider (IdP) like Google, Microsoft, or Apple.
• When you intercept a /authorize endpoint containing parameters like client_id, redirect_uri, response_type=code, and state.
• To establish full Account Takeover (ATO) by linking an attacker's social account to a victim's primary profile.

Prerequisites

• Authorized scope and target URLs from bug bounty program
• Burp Suite Professional (or Community) configured with browser proxy
• Familiarity with OWASP Top 10 and common web vulnerability classes
• SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Identifying the Authorization Request

# Concept: OAuth relies on bouncing the user between the Client app and the IdP app.
# The security of this entire sequence relies heavily on perfectly implemented parameters.

# 1. Intercept the classic OAuth "Sign in with..." click:
GET /oauth/authorize?client_id=XYZ123&redirect_uri=https://target.com/callback&response_type=code&state=999abc HTTP/1.1
Host: accounts.google.com

# Key Parameters:
# - redirect_uri: Where the IdP sends the user after login.
# - response_type: `code` (secure server flow) or `token` (insecure implicit frontend flow).
# - state: The anti-CSRF token binding the redirect back to the user's specific web browser session.

Phase 2: Missing or Unvalidated the "State" Parameter (Account Takeover / Linking)

# Concept: If an application allows users to link a social account to their profile, 
# and it DOES NOT strictly validate the `state` parameter upon return (CSRF), an attacker can link THEIR 
# social account to the VICTIM'S profile.

# Exploit Steps:
# 1. The attacker creates an account on `target.com` and clicks "Link Google Account".
# 2. The attacker logs into their Google account. 
# 3. Google redirects the attacker BACK to the target application:
#    `https://target.com/callback?code=SECRET_EVIL_CODE&state=`
# 4. **CRUCIAL STEP**: Before the browser loads this URL, the attacker INTERCEPTS and drops the request.
# 5. The attacker constructs a phishing link using that exact URL:
#    `https://target.com/callback?code=SECRET_EVIL_CODE`

# 6. The victim (who is currently logged into target.com) clicks the malicious link.
# 7. `target.com` processes the attacker's `SECRET_EVIL_CODE`.
# 8. Success: The attacker's Google account is now permanently attached to the victim's target.com account. The attacker signs in via Google and hijacks the account.