> For the complete documentation index, see [llms.txt](https://blog.dhilipsanjay.in/ctfs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.dhilipsanjay.in/ctfs/portswigger-academy/portswiggeracademy/lab3.md). # OAuth account hijacking via redirect\_uri **Date:** 04, August, 2021 **Author:** Dhilip Sanjay S *** ## Task * This lab uses an **OAuth service** to allow users to log in with their social media account. * A **misconfiguration by the OAuth provider** makes it possible for an attacker to *steal authorization codes* associated with other users' accounts. * To solve the lab, steal an authorization code associated with the admin user, then use it to access their account and delete Carlos. * The admin user will open anything you send from the exploit server and they always have an active session with the OAuth service. * You can log in with your own social media account using the following credentials: `wiener:peter`. *** ## Solution * Understand the OAuth flow. * There is no validation on the `redirect_uri`. * Create an iframe with the `redirect_uri` pointing to **exploit server** in the exploit server: ```bash