Learn How Hacker Hacks any Account with Oauth

Hi everyone, hope you all are doing good. I have not posted for a while because of my college exams and stuffs. So in this post, we are going to see how i found a misconfigured facebook oauth which allowed me to register with literally anyone’s account.

So….Let’s Begin 🙂

So first of all let’s know a little bit of Oauths.

What is OAuth?

Have you ever seen a webpage where you can register via facebook or google or any other service? If yes, then you already know the use of Oauths.

In simple terms, Oauth is a functionality in web applications that allows users to register or login via a third party website(example: Facebook, Google,Apple,Twitter etc)

How it works?

Here is one simple example of demonstrating the working of oauth:

So whenever you click on “Login with Facebook” or anything else, this is what happening behind the scenes:

1- The Web application sends a request to the server(let’s say google.com).

2- The user then click on his/her google account.

3- The google server verifies the credentials and sends a access token code back to the web application.

4- The web application verifies the token and finally you get logged in or registered. (This is where i found the vulnerability)

So that’s all about Oauth…if you want to know more about oauth, please visit the link below..i am not going to explain a lot about oauth since it will it will increase the length of this article.

For depth understanding, Please visit: https://www.varonis.com/blog/what-is-oauth/

So let’s get started

ABOUT THE VULNERABILITY:

#1-Analysis

So i was just hunting on a private program(let’s say hackedprogram.com) and i don’t know why but i started right on the main domain

The first thing which i do is to look for authentication functionalities(like login, register and oauth) and password reset functionality.

I then started testing the register functionality and found the following:

1- We can register via the old method(By filling form)

2- We can use Facebook Oauth.

At first i tried to find something in the normal registration method(via forms) but i didn’t find anything good..then i moved to test the Facebook Oauth implementation.

And this is what i found:

1- When the facebook server sends the code to the web application, the sever then uses a email and name parameter to add the user to its database.

2- The name and email parameter and not being validated properly at the sever side.

#2-Attack

Knowing these two thing, I started to register again using the Oauth functionality, but this time i change the name and email parameter to Hacked Account and [email protected] respectively.

Original Request
Modified Request

And after forwarding this request, I got the following response:

Response

And now, for the confirmation

Vulnerability Confirmed 😀

After this i was like:

And finally, I reported this vulnerability to the company.

#3-Takeaways

1- Always test each and every functionality of the web application.

2- Sometimes, just follow your instincts.

3- Deeply analyze the working of each functionality.

4- And my favorite, Follow the road less traveled 😉

So that’s it for this article, Hope you guys learnt something new and interesting. 🙂

If you want to learn more about cybersecurity, then please check out out other posts as well:

First Bug Bounty: Account Takeover

And let me tell you one thing

You can follow me on:

Twitter: https://twitter.com/FaIyaZz007

Linkedin: https://www.linkedin.com/in/faiyaz-ahmad-64457520b/

UPDATE: If anyone who is interested in hacking windows with just python then they can enroll the course below!.

Course Link: https://www.udemy.com/course/hacking-windows-with-python-from-scratch-2022/?referralCode=1647ED5816EFD5D2F2EB