> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-login-bypass-via-implicit-flow.md).
# 通过隐式流绕过 OAuth 登录
通过隐式流绕过 OAuth 登录，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过 OAuth 隐式流程绕过身份验证
#### 实验环境
本实验使用了一个 **OAuth** 提供商来支持通过社交网络账户登录。/ 由于客户端应用程序的验证不足 **客户端应用程序上的验证**，可以连接到另一个用户账户 **而无需知道其密码**.
目标：以……身份登录 **carlos** （电子邮件： `carlos@carlos-montoya.net`）。/ 可用的社交媒体账户： `wiener:peter`.
#### 观察
* 当尝试登录时，应用程序会重定向到一个 OAuth 页面：
* *“我们现在将把你重定向到使用社交媒体登录...”*
* 在 OAuth 域上完成身份验证并接受权限（个人资料 + 电子邮件）后，应用程序随后会向内部端点发送请求，通常为：
* `POST /authenticate`
* 此请求包含如下类型的 JSON：
{% code overflow="wrap" %}
```json
{
"email":"wiener@hotdog.com",
"username":"wiener",
"token":"MkydN3cYAC6wsKXQJEd5tD3kW1nB9MoWqzdfhyL6BtE"
}
```
{% endcode %}
关键在于：应用程序 **信任** 该 `email` 和 `用户名` 客户传递的字段，而不是 **严格地** 将这些值关联到 `token`.
```json
{
"email":"carlos@carlos-montoya.net",
"username":"carlos",
"token":"MkydN3cYAC6wsKXQJEd5tD3kW1nB9MoWqzdfhyL6BtE"
}
```
#### 利用
1. 通常使用该账户通过 OAuth 连接 **wiener**.
2. 拦截发送到 `POST /authenticate`.
3. 仅更改身份字段，保持相同的 `token`:
4. 发送修改后的请求。
#### 结果
* 服务器响应 **`302 已找到`**，这表明会话已创建，并且应用程序认为该用户已通过身份验证。
* 然后我们就获得一个以 Carlos 身份连接的会话 \*\*。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/oauth-authentication/oauth-login-bypass-via-implicit-flow.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)