This page simulates an attacker-controlled server at app.example.test.attacker.test.
app.example.test.attacker.test
To trigger the attack, craft an authorization URL like this:
GET /oauth/authorize?client_id=app&redirect_uri=http://app.example.test.attacker.test/evil&state=attack
The prefix check allows it because the URI starts with http://app.example.test.
http://app.example.test
Launch attack (use this server as attacker)