# device_code_server.py - Authorization server with too-fast polling
import time, secrets
codes = {}

@app.route('/device/code')
def device_code():
    code = secrets.token_urlsafe(16)
    codes[code] = {'user_code': secrets.token_hex(4), 'status': 'pending'}
    return jsonify(codes[code])

@app.route('/token')
def token():
    code = request.args['device_code']
    # Vulnerability: allows polling every 1 second, and attacker can brute-force user_code
    if codes[code]['status'] == 'pending':
        # Check if user_code was entered (simulated)
        time.sleep(0.5)  # delay to simulate user
        return jsonify({'access_token': 'secret'})

pip install flask
python device_code_server.py
# Attacker starts flow, gets device_code and user_code, phishes victim.