Free Link 🎈

Hey there!😁

The Prelude: When Coffee Met OAuth

You know those days where all you want is a peaceful morning with your laptop, some recon, and your third cup of coffee? Yeah… this wasn’t one of those. My browser had more tabs than a conspiracy theorist’s desktop, Burp Suite was throwing a tantrum, and OAuth was about to become the main character of my chaos.

I stumbled upon a wild login page during my recon marathon. My gut whispered, “Check the OAuth config.” My brain replied, “We barely understand our own login flow.” 🤦‍♂️

After mapping the flow, I discovered the app was using a third-party provider (let’s call it login.susprovider.com).

When I initiated a login, the following endpoints showed up in my Burp history:

https://target.com/auth/authorize?response_type=co…