Skip to content
attack.paths
Sign in
← RegistryDossier · 8 steps · 7 edges

OAuth redirect_uri misconfig → account takeover

Provider accepts loose redirect_uri matching (wildcard, partial, open-redirect chain). Steal the authorization code by redirecting it through an attacker host.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: OAuth provider (often the target's own SSO) accepts redirect_uri patterns that resolve to attacker-controlled hosts — either wildcards, missing path validation, or a chained open redirect on a whitelisted host.

§ Steps

  1. 01
    Account takeoverInitial Access
    T1078— Valid Accounts
  2. 02
    Send victim the malicious authorize linkInitial Access
    T1566— Phishing
  3. 03
    Exchange code for access tokenLateral Movement
    T1550— Use Alternate Authentication Material
  4. 04
    Find an open redirect on a whitelisted hostInitial Access
    W-OPEN-REDIRECT— Open Redirect
  5. 05
    Map OAuth provider & client configsReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  6. 06
    Capture authorization codeCredential Access
    W-OAUTH-MISCONFIG— OAuth — redirect_uri Misconfig
  7. 07
    Chain redirect to attacker hostCredential Access
    W-OAUTH-MISCONFIG— OAuth — redirect_uri Misconfig
  8. 08
    Probe redirect_uri validationCredential Access
    W-OAUTH-MISCONFIG— OAuth — redirect_uri Misconfig

    Try suffix/subdomain attacks, %2f, @-tricks.

§ References

§ Frequently asked

What is the "OAuth redirect_uri misconfig → account takeover" attack path?
Provider accepts loose redirect_uri matching (wildcard, partial, open-redirect chain). Steal the authorization code by redirecting it through an attacker host. It chains 8 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Account takeover (T1078) — a initial access primitive. Assumed environment: OAuth provider (often the target's own SSO) accepts redirect_uri patterns that resolve to attacker-controlled hosts — either wildcards, missing path validation, or a chained open redirect on a whitelisted host.
What is the final impact of this kill-chain?
The final step lands on Probe redirect_uri validation (W-OAUTH-MISCONFIG), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers