> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/forced-oauth-profile-linking.md).
# 强制 OAuth 资料链接
强制 OAuth 资料链接，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 强制 OAuth 资料关联
**实验描述**
本实验提供一项功能，可将社交网络资料关联到用户账户，以通过 OAuth 连接，而不是使用传统身份验证。/ 由于客户端 OAuth 流程的实现不安全，攻击者可以劫持此机制，将自己的社交资料关联到其他用户的账户。
目标：/ 执行一次 CSRF 攻击，将你的社交网络资料关联到网站管理员账户，然后访问管理面板并删除用户 **carlos**.
约束：
* 管理员会系统性地打开从运行服务器发送来的任何内容。
* 管理员在博客站点上始终保持活动会话。
**可用账户**
* 网站账户： `wiener / peter`
* 社交网络资料： `peter.wiener / hotdog`
**OAuth 机制分析**
* 该网站允许通过登录名和密码进行传统登录。
也可通过 OAuth（社交网络）登录。
* 现有用户可以将社交网络资料关联到其账户。
在关联过程中，会向认证端点发送一条 OAuth 请求：
{% code overflow="wrap" %}
```http
GET /auth?client_id=s4z8vs36ubaet908r8qfn&redirect_uri=https://0ac30047040d749984bf3b740088002a.web-security-academy.net/oauth-linking&response_type=code&scope=openid%20profile%20email HTTP/2
```
{% endcode %}
身份验证后，用户会被重定向到一个包含 OAuth 代码的 URL：
```http
GET /oauth-linking?code=pYNeIWIFHaUh_fmTub7fAYLzcyNAEvDoKMh9iljTU1Q HTTP/2
```
此代码：
* 仅可使用一次
* 用于将 OAuth 资料关联到当前已认证的账户
**漏洞利用**
1. 开始将你的账户与社交网络资料进行关联。
2. 拦截并复制 `/OAuth-linking?code=...` URL。
丢弃该请求，以免代码被消耗。
从运行中的服务器，通过 CSRF 攻击将此 URL 发送给管理员，例如使用 iframe
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
管理员加载该页面：
OAuth 代码已被消耗
攻击者的 OAuth 资料已关联到管理员账户
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/forced-oauth-profile-linking.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
