OAuth authentication

Apprentice lab:
Authentication bypass via OAuth implicit flow

This lab uses an OAuth service to allow users to log in with their social media account. Flawed validation by the client application makes it possible for an attacker to log in to other users' accounts without knowing their password.
To solve the lab, log in to Carlos's account. His email address is [email protected].
You can log in with your own social media account using the following credentials: wiener:peter.

• Solution

  1. Click on My account. Notice Connection: keep-alive header is needed.
  2. Switch on using HTTP/1 protocol.
  3. Study the requests made, after you log in as wiener:peter.
  4. Modify the POST request made.
     • from

     {
         "email": "[email protected]",
         "token": "qDqwIzbwJZ1uu2KnQNpoMyp5gUtTiRib5g0w-4W-T7j",
         "username": "wiener"
     }

     • to

     {
         "email": "[email protected]",
         "token": "qDqwIzbwJZ1uu2KnQNpoMyp5gUtTiRib5g0w-4W-T7j",
         "username": "carlos"
     }

  5. Lab is solved.

NOTE:
Burp switches protocols automatically.

Practitioner lab:
SSRF via OpenID dynamic client registration (Pro)

---