Target: https://developers.sber.ru/portal/auth
Attacker page: https://poc.78-17-98-39.sslip.io/
Collector: https://oob.78-17-98-39.sslip.io/STOLEN-OAUTH-CODE
Researcher: riptacol
This page is hosted on an unrelated third-party host. It opens the legitimate Sber ID login flow in a popup. The callback page at developers.sber.ru sends its query string, containing the authorization code and state, to window.opener with targetOrigin '*', so this page receives it and forwards it to the attacker collector.
not executed yet