I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here

Though I understood the nature of the bug and how it can be abused by attackers, I couldn't figure out how to exploit it. I have read many articles about it and came across a URL which can be used to test this vulnerability for educational purposes. (You can find the two links for testing below.

JSON security

Public key

Does anyone have any thoughts on how I can exploit this?

  • can anyone please shower your interest here?. – Goron Jun 6 '18 at 8:58

Finally I bypassed it with custom JWT algorithm, where HMAC accepts public key as its secret key. Which cannot be done in python's pyjwt module or any other language since it is fixed.

Check out POC code here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.