Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here
Though I understood the nature of the bug and how it can be abused by attackers, I couldn't figure out how to exploit it. I have read many articles about it and came across a URL which can be used to test this vulnerability for educational purposes. (You can find the two links for testing below.
Does anyone have any thoughts on how I can exploit this?
Finally I bypassed it with custom JWT algorithm, where HMAC accepts public key as its secret key. Which cannot be done in python's pyjwt module or any other language since it is fixed.
Check out POC code here
