Using hashcat in order to crack the JWT signature in WebGoat

Question

I've recently started to practice my penetration testing skills and I got started with WebGoat.

I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT Token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJXZWJHb2F0IFRva2VuIEJ1aWxkZXIiLCJpYXQiOjE1MjQyMTA5MDQsImV4cCI6MTYxODkwNTMwNCwiYXVkIjoid2ViZ29hdC5vcmciLCJzdWIiOiJ0b21Ad2ViZ29hdC5jb20iLCJ1c2VybmFtZSI6IlRvbSIsIkVtYWlsIjoidG9tQHdlYmdvYXQuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19.vPe-qQPOt78zK8wrbN1TjNJj3LeX9Qbch6oo23RUJgM

and asks you to change the username to WebGoat, and submit the new JWT token. This means I need to find with what secret the hash function is generating the signature.

In order to do that, WebGoat recommends to use HashCat with a 10000 words list, which I tried to do through my Kali Linux 2018.4 (running on a vmware player virtual machine) with the command:

$ hashcat -a 0 -m 1450 text.hash /root/wordlists/google-10000-english-master/google-10000-english.txt

Unfortunately, I get this error:

* Device #1: This device's constant buffer size is too small.

* Device #1: This device's local mem size is too small.

No devices found/left.

---

These are my specs:

I supplied the Kali Linux with 4 GB RAM and and 4 processors.

I just want to solve this stage and move on, I don't mind using any other program that is preinstalled in the Kali, and if it's even better than HashCat, then please tell me!

I also don't mind writing the code myself for bruteforcing but I'm sure it won't be as efficient as what is offered on the internet.

Answer 1

JWT Token Structure

As detailed on the JWT website (https://jwt.io/introduction/), JWT token consists of three parts separated by a dot (.), which are - Header, Payload and Signature. Both Header and Payload are Base64 encoded strings.

Therefore a JWT token would typically look like this: Base64(Header).Base64(Payload).Signature

The signature is created by taking both the header and the payload, use a secret key to create a signature by using the algorithm specified in the Header.

Finding JWT Secret Key

What you need to do to solve this challenge is to find the secret key that has been used to create the signature. This can be done by using a brute force attack to calculate the signature by using different secret keys either from a wordlist or through a pure brute force attack.

The correct syntax to use to conduct brute force attack to find the secret key using Hashcat is:

Using a Wordlist:  
$ hashcat -a0 -m 16500 text.hash [dict]

Pure Brute force attack:  
$ hashcat -a3 -m 16500 text.hash

The option -m 16500 is the correct Hash Mode to brute force JWT tokens using Hashcat. The one that you have used (-m 1450) is for raw HMAC-SHA256 hash and is applied to the whole string, therefore resulting in an error.

The above method works fine for me to find a secret key for a given JWT token, however, I am not able to solve the WebGoat challenge yet. I am trying to get in touch with the Webgoat team to understand the problem and to solve this challenge. I will provide an update when I hear back from them and can solve the challenge.