From Zero Credentials to Super Admin An SSO Authentication B...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://medium.com/@Tyrion404/from-zero-credentials-to-super-admin-an-sso-authentication-bypass-on-at-t-996fe9d0ec1e
• Blog Title: From Zero Credentials to Super Admin: An SSO Authentication Bypass on AT&T
• Suggested Section: Pentesting Web -> Login Bypass / OAuth to Account takeover / Account Takeover, with a related addition or cross-reference under 80,443 - Pentesting Web -> Spring Actuators

🎯 Content Summary

Overview

The post reports an application-level authentication and authorization failure in a Spring Boot corporate procurement analytics platform used for supplier contracts, vendor spending, and internal financial forecasting. The application contained a highest-privilege Super Admin role. The complete chain required no credentials and reportedly reached a Super Admin session in less than 60 seconds. No CVE number is provided; this was an application-specific logic flaw ...

🔧 Technical Details

Unauthenticated management-log disclosure: Exposing a Spring Boot Actuator logfile endpoint such as /api/actuator/logfile can disclose runtime authentication records. If logs contain usernames, internal IDs, email addresses, roles, or permissions, an attacker can harvest a valid identity—possibly a privileged one—and use it as input to other authentication or authorization flaws. ([medium.com](https://medium.com/%40Tyrion404/from-zero-credentials-to-super-admin-an-sso-authentication-bypass-on-at-t-996fe9d0ec1e))

Secrets in public frontend configuration: Static assets such as config.js are readable by unauthenticated users and must be treated as public. Placing API keys, OIDC credentials, or cloud-storage SAS tokens in the file allows attackers to satisfy secondary API-header requirements or directly abuse exposed cloud permissions. The reported SAS token carried all thirteen read/write/delete permission flags. ([mediu...

🤖 Agent Actions

Updated src/pentesting-web/oauth-to-account-takeover.md.

Added:

• Username-only SSO-to-JWT authentication bypass methodology.
• Actuator logfile and API-directory username harvesting.
• Public config.js/API-key considerations.
• Token replay and arbitrary identity impersonation workflow.
• Safe account-takeover/integrity validation steps.
• Correct OIDC authorization-code validation guidance.
• Spring Actuator cross-reference and numbered blog citation.

Validation completed:

• git diff --check passed.
• Internal link target exists.
• All 25 numbered references resolve.
• Forbidden sources are absent.
• Only the intended file was modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://medium.com/@Tyrion404/from-zero-credentials-to-super-admin-an-sso-authentication-bypass-on-at-t-996fe9d0ec1e

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Login Bypass / OAuth to Account takeover / Account Takeover, with a related addition or cross-reference under 80,443 - Pentesting Web -> Spring Actuators".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0