OAuth / Okta Misconfiguration
Last updated
Last updated
The client_id and connection parameters, crucial to the system's environment, can be obtained through various methods. One approach involves intentionally attempting to authenticate with invalid credentials.
After acquiring the client_id and connection parameters, the next step involves verifying if the system supports registration through the Auth0 API. To do this, we initiate a POST request to "/dbconnections/signup"
In the SSO feature. For example the URL will be looks like this
OAuth token stealing by changing redirect_uri and Use IDN Homograph
Normal parameter
IDN Homograph
If you notice, im not using the normal e
OAuth Token Re-use.
Improper handling of state parameter
To exploit this, go through the authorization process under your account and pause immediately after authorization. Then send this URL to the logged-in victim
CSRF Attack
Lack of origin check.
Open Redirection on redirect_uri parameter
Normal parameter
Open Redirect
If there is an email parameter after signin then try to change the email parameter to victim's one.
Try to remove email from the scope and add victim's email manually.
Check if its leaking client_secret
After successful authentication, the authorization server redirects the user to a specified URI with an authorization code
Craft a URL that redirects this code to a malicious domain
logo_uri and jwks_uri are particularly interesting for SSRF attacks
Create an account with with normal functionality. Create account with using OAuth functionality. Now try to login using previous credentials.
The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.
