OAuth2: State Fixation

This course covers the exploitation of an insecure OAuth2 Client susceptible to a state fixation vulnerability. The OAuth2 Client uses OAuth2 as a pseudo-authentication mechanism, but it is vulnerable because the state parameter, used to prevent CSRF, can be manipulated via a CSRF attack. By exploiting this weakness, an attacker can link the victim's account to their own and gain unauthorized access.

To exploit this vulnerability, one must register a malicious account on the Authorization Server and manipulate the state parameter during the OAuth2 dance. This involves priming the victim's session with a specific state and then using a valid code from the Authorization Server to complete the attack. The lab demonstrates how to create a malicious HTML page to perform these steps, ultimately allowing the attacker to log in as the victim.