PKCE `plain` Method Bypass
mobile · medium · +45 XP
Target
POST /api/lab/pkce-bypass-101/auth body {client_id, code_challenge, code_challenge_method}
POST /api/lab/pkce-bypass-101/token body {code, code_verifier}
POST /api/lab/pkce-bypass-101/submit body {access_token}
Goal: send code_challenge_method=plain (NEVER use it in real life). The server then accepts ANY code_verifier at /token. Submit the access-token you get back.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/pkce-bypass-101/
// reuse on the cli
// submit flag
// no solves yet
9 of 12 · mobile