4 ms·
Example.com has an open redirect; say http://example.com/redirect?url=xxxxx http://example.com/redirect?url=xxxxx Craft the OAuth URL to Twitter passing the ca
by jmathai 13y ago
Example.com has an open redirect; say http://example.com/redirect?url=xxxxx http://example.com/redirect?url=xxxxx
Craft the OAuth URL to Twitter passing the callback as http://example.com/redirect?url=http://mallory.com/capture http://example.com/redirect?url=http://mallory.com/capture.
Now Mallory can access the parameters passed back by Twitter at /capture on their server.
Questions:
1. You have to look at the referer to get the tokens, no?
2. OAuth 1.0a isn't vulnerable because the requests are signed with a secret, correct?
- saleemshafi 13y agomy understanding is that OAuth 1.0a isn't vulnerable because in that spec, the access_token isn't part of the post-user-authorization redirect (http://tools.ietf.org/html/rfc5849#section-2.2 http://tools.ietf.org/html/rfc5849#section-2.2) while it is in Oauth 2.0 (http://tools.ietf.org/html/rfc6749#section-4.2.2 http://tools.ietf.org/html/rfc6749#section-4.2.2) So, in Oauth 2.0 the redirect URI could be setup to expose the access token. In Oauth 1.0a, the only thing that could leak is the request token and verifier code, but without the original client credentials, they can't be exchanged for an access token.