๐Ÿšจ Fresh Session Cookie Exploit Server

โš ๏ธ Warning: This is a demonstration of a security vulnerability. Only use this for authorized security testing.

๐Ÿ“Š Status

โœ… Server Running: Ready to capture fresh session cookies
๐Ÿ“ก Endpoint: http://localhost:9000/collect
๐ŸŽฏ Sessions Captured: 3

๐Ÿงช Test the Vulnerability

โšก NestJS Login Redirect - Fresh Session Cookie Capture

No domain setup needed! Works with localhost directly!

Enter your target backend URL:

๐Ÿšจ Test Fresh Session Cookie Exploit

What happens:
1. Victim is sent through OAuth login flow
2. After successful login, victim is redirected to this server
3. Fresh session cookie is captured immediately! ๐ŸŽฏ
4. Works because returnUrl parameter has ZERO validation
5. Optionally captures additional credentials via fake login form

๐Ÿ“ Typical vulnerable endpoint pattern: /auth/*/login?returnUrl=

๐Ÿ“Š Monitor Results

View Admin Panel to see all captured data

โš ๏ธ Why This is Critical

๐Ÿ›ก๏ธ How to Fix

// Implement proper URL validation:
private validateReturnUrl(returnUrl: string | undefined): string {
  if (!returnUrl || returnUrl === 'undefined') {
    return this.configService.frontendUrl;
  }

  try {
    const parsed = new URL(returnUrl);
    const allowedHosts = [
      'your-frontend.com',
      'your-domain.com'
      // DO NOT include localhost in production!
    ];

    // Exact hostname match only
    if (allowedHosts.includes(parsed.hostname)) {
      return returnUrl;
    }
  } catch (e) {
    // Invalid URL format
  }

  // Default to safe URL
  return this.configService.frontendUrl;
}

// Then use in your controller:
@Get('login')
async login(@Query('returnUrl') returnUrl: string) {
  const safeReturnUrl = this.validateReturnUrl(returnUrl);
  // Use safeReturnUrl for redirects
}

๐Ÿ”— Additional Resources