BACKGROUND

This lab gives you the option to attach a social media profile to your account so that you can log in via OAuth instead of using the normal username and password. Due to the insecure implementation of the OAuth flow by the client application, an attacker can manipulate this functionality to obtain access to other users' accounts. To solve the lab, use a CSRF attack to attach your own social media profile to the admin user's account on the blog website, then access the admin panel and delete carlos. The admin user will open anything you send from the exploit server and they always have an active session on the blog website. You can log in to your own accounts using the following credentials: Blog website account: wiener:peter Social media profile: peter.wiener:hotdog

---

After observing the flow, it uses authorization grant type or flow and it doesn't send the state parameter which prevent csrf like attacks by preventing a flow which wasn't started by the client. So we Start the flow by linking to a social media profile and drop the request to not use it when we receive the ouauth-linking code which allows us to link the account to our social media account, so by dropping it we do not use it and we put it inside an iframe to make the admin execute it.

<iframe src="https://0ab500ab03372b7c81abcaf80077006e.web-security-academy.net/oauth-linking?code=2ylpuwjVq2S16PLpGpZEAAfjHHPrmLPcC9giRMoNSy-"></iframe>