OAuth Phishing - 2020

Lets explore the present OAuth phishing issue.Recently, I started hunting Google and found a Google subdomain that contains a OAuth misconfiguration,where we can tamper the ContinueUrl and make the victim get redirected to the Evil page but the sad part is no OAuth token were leaked and only the state token was leaked.The state parameter generates random strings everytime which is of no use.Still i wanted to try my luck,so i reported to Google.After some conversations the report was closed as Intended behaviour :(

I know that the OAuth request from that subdomain can be called directly and after authorization it goes to the attackers endpoint.Hence we can make Google as a medium for our Phishing Page as it ensures trust.

Proof Of Concept:

The Proof of Concept is pretty simple. We know the vulnerable endpoint,all we need to do is to tamper the continue URL and change it to malicious website and send it to the victim via Gmail or any source.

Since the endpoint is accounts.google.com,there is an extreme difference between clicking xyz.yyz.com and accounts.google.com.Hence the victim will not be too cautious about the link.When the victim clicks the link he will be sent to the login page for authentication.

After successful authentication,The victim will be redirected to the attacker website.

It might look like a lame attack but its effective for making the victim click the link and trusting the redirection.Social engineering is simply the exploitation of natural human tendency to trust.Building the trust is very important for a social engineering attack.

Watch Who You Trust,Even your Teeth Bite Your Tongue Every Then and Now.

A simple Proof of concept video demonstrating the issue,Using Google OAuth as a medium there is a great tendancy for the social engineering attacks.

Awareness is a key ingredient in success. If you have it, teach it, if you lack it, seek it.

Thank You for Giving your time for reading the article!!,Thanks Hema for helping me with this article.

Linkedin : https://www.linkedin.com/in/kabilan-s-4b8a90173

Instagram : https://www.instagram.com/username_.not._available/