webPromedium
DevRelay — Open Redirect in OAuth Authorization
hackadvisor
Task: DevRelay API platform uses OAuth 2.0 Authorization Code flow with no redirect_uri validation, plus an admin bot that visits user-submitted URLs. Solution: Craft malicious OAuth authorize URL redirecting the admin's auth code to a Request Bin, exchange the code for an access token, and access /api/admin/secrets.
$ ls tags/ techniques/
nodejssession_hijackingnginxexpressadmin_botoauth2open_redirectauthorization_code_flowrequest_bintoken_exchange
admin_bot_exploitationoauth_redirect_uri_open_redirectauthorization_code_interceptionrequest_bin_exfiltrationoauth_token_exchange
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 348 — Connectify — IDN Homograph OAuth Open Redirect— hackadvisor
- [web][Pro]Lab 4 — EdgeRelay — HTTP Request Smuggling via CL-TE Desync— hackadvisor
- [web][Pro]Lab 173 — ConnectHub — OAuth Open Redirect via URL Userinfo Bypass— hackadvisor
- [web][Pro]Lab 35 — GateKeeper SSO — Open Redirect via Regex URI Validation— hackadvisor