I am using Django OAuth toolkit in a intentionally vulnerable application. I am painting a scenario in which for example I there is a client application with redirect_uri abc.com.
I want to show to the user that in OAuth 2.0 if the redirect_uri is not specifically well taken care of the attacker can manipulate and redirect it to their own server.

In this case, if the attacker sends a link to the victim with redirect_uri, they will be able to receive the victim’s authorization code.
Now, my first question is that I cannot see wildcard URI being possible in the OAuth toolkit. Is there any way I can enable it? Otherwise, I have to add evil.com to the allowed redirect_uri section of the app, which is not a valid scenario.

Similar to this one, if the attacker receives the authorization code after redirecting the user to attacker.com. From the authorization code, I cannot get the token as the OAuth toolkit also verifies the redirect_uri once the code is generated. Is there any way to bypass that so that the access token should be easily gerneateable?