<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Topics tagged with offsec]]></title><description><![CDATA[A list of topics that have been tagged with offsec]]></description><link>https://board.circlewithadot.net/tags/offsec</link><generator>RSS for Node</generator><lastBuildDate>Mon, 06 Apr 2026 03:51:12 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/tags/offsec.rss" rel="self" type="application/rss+xml"/><pubDate>Invalid Date</pubDate><ttl>60</ttl><item><title><![CDATA[OAuth account takeover doesn&#x27;t need leaked tokens.]]></title><description><![CDATA[@rsgbengi Hey. Thanks for the writeup. I feel like there is either an error or a missing attack type in the redirect_uri section, when it comes to subdomain confusion. The trick I know is using the entire domain as a subdomain to your own domain, so to use legitimate.com.evil.com as the redirect_uri to attack a wildcard like legitimate.com* (without a slash before the wildcard).I'm not aware of any OAuth issues that would allow you to add an extra subdomain to a redirect URI - is that a thing as well? Keycloak does not expand wildcards that aren't the final character of the redirect URI, so *.legitimate.com would not be a working wildcard, but other implementations may differ.]]></description><link>https://board.circlewithadot.net/topic/4dd5d45d-6cd0-407d-9e97-575ef5e45cce/oauth-account-takeover-doesn-t-need-leaked-tokens.</link><guid isPermaLink="true">https://board.circlewithadot.net/topic/4dd5d45d-6cd0-407d-9e97-575ef5e45cce/oauth-account-takeover-doesn-t-need-leaked-tokens.</guid><dc:creator><![CDATA[hacksilon@infosec.exchange]]></dc:creator><pubDate>Invalid Date</pubDate></item></channel></rss>