exploiting-oauth-misconfiguration

# Exploiting OAuth Misconfiguration ## When to Use - During authorized penetration tests when the application uses OAuth 2.0 or OpenID Connect for authentication - When assessing "Sign in with Google/Facebook/GitHub" social login implementations - For testing single sign-on (SSO) flows between applications - When evaluating API authorization using OAuth bearer tokens - During security assessments of applications acting as OAuth providers or consumers ## Prerequisites - **Authorization**: Written penetration testing agreement covering OAuth/SSO flows - **Burp Suite Professional**: For intercepting OAuth redirect flows - **Browser with DevTools**: For monitoring redirect chains and token leakage - **Multiple test accounts**: On both the OAuth provider and the target application - **curl**: For manual OAuth flow testing - **Attacker-controlled server**: For receiving redirected tokens/codes ## Workflow ### Step 1: Map the OAuth Flow and Configuration Identify the OAuth grant type, endpoints, and configuration. ```bash # Discover OAuth/OIDC configuration endpoints curl -s "https://target.example.com/.well-known/openid-configuration" | jq . curl -s "https://target.example.com/.well-known/oauth-authorization-server" | jq . # Key endpoints to identify: # - Authorization endpoint: /oauth/authorize # - Token endpoint: /oauth/token # - UserInfo endpoint: /oauth/userinfo # - JWKS endpoint: /oauth/certs # Capture the authorization request in Burp # Typical authorization code fl...