This website is a virtual proof that I'm awesome https://blog.surajdisoja.me/ Chaining misconfigurations for your access token. - Tl;dr: An OAuth misconfiguration was discovered in the redirect_uri parameter at the target’s OAuth IDP at https://app.target.com/oauth/authorize, which allowed attackers to control the path of the callback endpoint using the... Mon, 21 Feb 2022 00:00:00 -0500 https://blog.surajdisoja.me/2022-02-21-oauth-postmessage-misconfig/ https://blog.surajdisoja.me/2022-02-21-oauth-postmessage-misconfig/ Open redirection to account takeover - Recently, while testing a web application, I discovered multiple vulnerabilities that on chaining together could have allowed anyone to take over the Victim account. The affected company name is interchanged... Mon, 05 Oct 2020 00:00:00 -0400 https://blog.surajdisoja.me/2020-10-05-open-redir-to-ato/ https://blog.surajdisoja.me/2020-10-05-open-redir-to-ato/