Sample OAuth protocal base servers and client

-
this application was created by spring boot. it has 3 major component those are authorization server, resource server and client-server. each component should have unique tomcat instance to running itself.

  • Client-Application: this application is running on localhost:9999 port. it has 3 classes, which are in main/java directory. those classes are App.java, AppController.java and AppRestController.java also, the client application has index.html file and some other clients site languages file within the resource/static file. App.java is main class for this client application. AppConroller class sets paths for each file. last class is AppRestController. it will do OAuth follows.
  • Authorization server: it is running on localhost:8081 and also it has 3 classes which are AuthorizationServer.java, OAuthConfig.java and SecurityConfig.java. 1st one is main class it uses to run the application. another one contains OAuth protocol functions. the last one defines the security aspect of each path.
  • Resource server: it is running on localhost:8082. this also has three classes those are  ResourceServer.java, User.java and UserData.java. this application does not have any database connections so user informations store into the UserData class with list format. User.java class maintain the user information and ResourceServer.java class is the main class of this server.

How this work?
1st we have to start up each server like this.
the path shows, where I store the server on my computer.

then you will get the client application when you visit this link (localhost:9999). that client app has a button called login with OAuth2.0. if you click that button, you will redirect to the Authorization server is Authorization endpoint.

that Authorization server promotes the resource owner login page 
after provides the username and password, authorization server will provide user consent page. that user consent page will ask permission of the resource owner for giving the client app.
if you authorized, authorization server provides Authorization code to the client's redirection endpoint. after that client makes the request for Authorization server's token endpoint with an Authorization code. then authorization code will provide the access token to the client server. then client makes resource request for the resource server with an access token. before providing the resource, resource server validates the access token with the Authorization server help. if validation succeeds, the resource server will send the resources to the client.

HOW TO GET RESOURCES FROM RESOURCE SERVER WITHOUT CLIENT APP
STEP1
we have to make authorization code request to the authorization server. that request should be below format 
"AuthorizationServerUrl + ResponseType + Clientid + RedirectionUrl + scope"(it must be get request)


sampleUrl:"http://localhost:8081/auth/oauth/authorize?response_type=code&client_id=1000123456&redirect_url=http://localhost:9999/oauth/access?key=value&scope=user_read%20user_write"

resource owner after permit the user consent page we will get the authorization code in redirectionUrl. below image shows this.

STEP2
make a access token request to the authorization server. that request should be POST request because it carries cilentID and clientSecret in the header(like this "clientID:clientSecret") and also requests body has clientID, redirectionUrl, grantType and authorization code. user ID and SECRET are given by authorization server when the client was registering. also HTTP header must be base64 encoded.

sample header 

sample body

the HTTP respone might be like this


STEP3
make the resource request to the resource server. that HTTP GET request header should have token type and value.
sample request

sample response 
this response should be a XML value.

you can get the source code from this link.

IF YOU HAVE ANY DOUBT ABOUT OAUTH PROTOCOL PLEASE CHECK THOSE LINKS. LINK1 LINK2

Comments

Post a Comment

Popular posts from this blog

Install android studio on the parrot os

-
Image
parrot OS is based on Linux environment so we have to download Linux version of android studio. if you want Linux version android studio just click here . after the download is completed you will get the zip file of the android studio. so you need to unzip it first. then you can see several files within the unzipped folder. figure 1 represents the sample output. Figure 1 then go to bin folder which is stored in the unzipped folder. after opening the bin folder, you can see studio.sh shell script. if you execute that, the android studio will be running on your PC's.  Note:- you have to give execute permission to studio.sh for the current user before you execute studio.sh script. (sudo chmod u+x studio.sh) Figure 2 but we will be doing like this. it's annoying, so now we are going to the terminal command that is helped to us to access android studio by using terminal commands.  move your unzipped file to "/root" from Downloads. then go to "/usr
Read more

How to do simple brute force attack with burp suite

-
Image
What is brute force attack? brute force is a kind of password based attack. normally attacker checks each and every possible combination until reaching the expected output. so an attacker should check the huge amount of data but the normal human cannot do this kind of things. that's why we must move on some predefine tools to do this kind of attacks. work through this is the sample login page. we are going to attack this page and get the login credentials.(note: this is a basic login form it does not have any prevention mechanism for brute force attack.) let's try any value on this form and capture the data packet for analyzing. after analyzed we can say these data packets have username and password, which we entered previously. so we have to forward this data packet to intruder tab (right click and select intruder option). now  go to the intruder and mark the target variables which are carrying username and password. The below figure shows that. Note:
Read more

PoC video of How to Hack Gmail and Bitcoin Wallet using SS7 flaw

-
Image
A long time ago we published a report about how someone can hack WhatsApp with the SS7 by default. The standard SS7 exists for eons now with corrections, but GSM and telecom companies do not bother or trouble to repair their infrastructure against the standard. Now a Cyber ​​Security Company called Positive Technologies has released a video detail as anyone in any Gmail account can hack with a name and a phone number with the standard SS7. After the abduction of the Gmail account of the victim, the investigators then tried to steal a Bitcoin wallet with the same SS7 defect. Positive researchers sent their video to Thomas Fox-Brewster, an investigating reporter for Forbes, as well as details about hacking. What is the SS7 error? The vulnerability is found in the signaling system 7 or SS7, the technology used by telecommunication operators where the high-security message system and telephone calls depend. SS7 is a set of telephone signaling protocols developed in 1975 that make i
Read more