Question

Before you dive into hunting for OAuth open redirect issues, you should first determine whether the website is using OAuth. You can figure this out by intercepting the requests to complete authentication on the website and look for the oauth keyword in the HTTP messages.

在你深入挖掘 OAuth 重定向问题之前，你应该先确定该网站是否正在使用 OAuth。你可以通过拦截完整身份验证请求并查看 HTTP 消息中的 oauth 关键字来确定这一点。

Then start looking for open redirect vulnerabilities. You can find details on how to find open redirects in Chapter 7 . Finally, see if you can smuggle the OAuth tokens offsite by using one of the open redirects that you’ve found.

然后开始寻找开放重定向漏洞。您可以在第七章中找到有关如何查找开放重定向的详细信息。最后，通过使用您找到的其中一个开放重定向，查看是否可以窃取 OAuth 令牌到外部网站。