At cyllective AG, we’re passionate about cybersecurity and committed to sharing our knowledge with the community. As a Swiss-based pentesting company, we constantly strive to enhance our understanding of security protocols and empower developers to write more secure code.

Today, we’re excited to introduce our latest project: the OAuth Labs. We’ve built this for both internal training purposes and our hands-on security-training ↗.

This lab setup is not just a tool — it’s an immersive learning experience designed to deepen your understanding of OAuth 2.0, explore its common vulnerabilities, and practice exploiting and defending against them in a controlled environment.

Why OAuth 2.0 Matters #

OAuth 2.0 has become the de facto standard for authorization in web and mobile applications. It enables third-party applications to obtain limited access to user data without needing to handle user credentials directly. This reduces security risks and enhances user trust. However, improper implementation can introduce vulnerabilities that attackers can exploit.

Understanding OAuth 2.0 isn’t just about knowing how to implement it; it’s about recognizing potential pitfalls and securing applications against them. That’s where our lab comes in.

What to Expect #

Deep Dive into OAuth 2.0 #

• Roles and Actors: Learn about the key players in the OAuth 2.0 framework, including the resource owner, client, resource server, and authorization server.
• Scopes and Permissions: Understand how scopes define the level of access granted to third-party applications.
• Tokens and Claims: Explore how access tokens and refresh tokens work, and how claims are used within JSON Web Tokens (JWTs).
• Grant Types and Flows: Study the different authorization grant types, such as the Authorization Code Grant, and how they facilitate secure communication between clients and servers.

Identifying and Exploiting Vulnerabilities #

• Lab 01: Claim Fail: See what happens when unstable claims are used to establish user identities, and learn how to exploit this vulnerability.
• Lab 02: Open Redirects without Restrictions: Discover the risks when an authorization server doesn’t validate the redirect_uri.
• Lab 03: Open Redirects with Domain Validation: Understand how partial validation can still leave applications vulnerable, and how to exploit these weaknesses.
• Lab 04: JWT Signatures … or a lack thereof: Learn the importance of proper JWT signature verification and the consequences of neglecting this crucial step.
• Lab 05: JWT Signatures - jku: Understand how loose validation of the jku claim can leave applications vulnerable, and how to exploit these weaknesses.

How the Lab Works #

Our lab environment is Docker-based, making it easy to set up and isolate from your main system. Each lab is self-contained and focuses on a specific vulnerability.

Lab Navigation #

Each lab consists of an authorization server and a client application:

• Authorization Server: Manages user authentication and issues tokens.
• Client Application: Represents a third-party application attempting to access resources on behalf of the user.

By interacting with these components, you’ll simulate real-world scenarios where vulnerabilities might occur.

A Sneak Peek into the Labs #

Lab 01: Claim Fail #

In this lab, you’ll examine what happens when a client relies on unstable claims within a JWT to establish user identity. You’ll learn how this can lead to authentication bypasses and how to prevent such issues by validating claims properly.

Lab 02 & 03: Open Redirect Vulnerabilities #

These labs focus on open redirect vulnerabilities arising from improper validation of the redirect_uri parameter:

• Lab 02: Explore a scenario where the authorization server does not validate the redirect_uri at all, leading to severe security risks.
• Lab 03: Investigate the risks when the server only validates the domain but not the full path, allowing attackers to craft malicious URLs.

Lab 04 & 05: JWT Signature Validation #

Delve into the importance of verifying JWT signatures. You’ll see firsthand what happens when signature verification is neglected or implemented poorly and how attackers can exploit weak implementations to gain unauthorized access.

Empowering Developers and Security Professionals #

Our OAuth 2.0 vulnerability lab is more than just a training tool — it’s part of our commitment to fostering a culture of security awareness and continuous learning. By providing this resource, we aim to:

• Enhance Security Skills: Equip developers and security professionals with hands-on experience in identifying and mitigating OAuth 2.0 vulnerabilities.
• Promote Best Practices: Encourage the adoption of secure coding practices and proper implementation of authorization protocols.
• Foster Collaboration: Create a platform for knowledge sharing and community engagement around OAuth 2.0 security.

Get Involved and Contribute #

We invite you to explore our lab, challenge yourself with the exercises, and contribute to the ongoing development of this project. If you discover new vulnerabilities, develop additional labs, or create content related to our labs, we’d love to hear from you.

Final Thoughts #

OAuth 2.0 is a powerful framework that, when implemented correctly, significantly enhances the security of web and mobile applications. However, like any technology, it’s only as strong as its weakest link. By understanding the potential vulnerabilities and learning how to address them, we can build more secure applications and protect user data more effectively.

We hope our OAuth 2.0 vulnerability lab provides valuable insights and practical experience. Let’s work together to make the digital world a safer place.

Ready to Dive In?

Access the lab and start your OAuth 2.0 security journey:

github.com/cyllective/oauth-labs ↗.

For any questions or feedback, feel free to reach out to us. Together, we can elevate our security practices and stay ahead of emerging threats.