Masked Menace: How a Fake OAuth App and a Loose GraphQL Endpoint Stole the Real Keys
一位安全测试人员在运行大规模侦察时发现了一个隐藏在OAuth授权流程后的GraphQL端点,并通过工具定位到一个可疑域名auth-api.target.com。 2025-8-10 05:37:29 Author: infosecwriteups.com(查看原文) 阅读量:16 收藏

Iski

Free link 🎈

Hey there!😁

Press enter or click to view image in full size

Image by Perplexity AI

One cold morning (well… the AC was on), I was running mass recon.
You know the drill: Spotify playing in the background, multiple terminal windows open, and me praying my internet wouldn’t drop mid-ffuf scan.

That’s when I stumbled upon something… shiny.
A GraphQL endpoint sitting quietly behind an OAuth authorization flow.
The kind of thing that doesn’t scream “I’m vulnerable,” but whispers, “Psst… I’ve got secrets.”

I wasn’t looking for your regular boring ?id=123 stuff. I wanted juicy — the kind of endpoint that corporate lawyers lose sleep over.
So I fired up my mass recon:

subfinder -d target.com | httpx -title -status-code -content-length -mc 200

Out popped a suspicious domain:

auth-api.target.com

文章来源: https://infosecwriteups.com/masked-menace-how-a-fake-oauth-app-and-a-loose-graphql-endpoint-stole-the-real-keys-cec06ed964cd?source=rss----7b722bfd1b8d---4
如有侵权请联系:admin#unsafe.sh