OAuth Refresh-Token Replay
mobile · easy · +35 XP
Target
GET /api/lab/oauth-reuse-101/token-cache (leaked refresh-tokens from app sandbox)
POST /api/lab/oauth-reuse-101/refresh body {refresh_token}
POST /api/lab/oauth-reuse-101/submit body {access_token}
Goal: pick the stalest refresh-token (issued > 90 days ago) — the IdP fails to expire revoked grants. Use /refresh to mint an access-token, then submit it for the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/oauth-reuse-101/
// reuse on the cli
// submit flag
// no solves yet