I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT Token:
and asks you to change the username to
WebGoat, and submit the new JWT token. This means I need to find with what secret the hash function is generating the signature.
In order to do that, WebGoat recommends to use HashCat with a 10000 words list, which I tried to do through my Kali Linux 2018.4 (running on a vmware player virtual machine) with the command:
$ hashcat -a 0 -m 1450 text.hash /root/wordlists/google-10000-english-master/google-10000-english.txt
Unfortunately, I get this error:
* Device #1: This device's constant buffer size is too small. * Device #1: This device's local mem size is too small. No devices found/left.
I supplied the Kali Linux with 4 GB RAM and and 4 processors.
I just want to solve this stage and move on, I don't mind using any other program that is preinstalled in the Kali, and if it's even better than HashCat, then please tell me!
I also don't mind writing the code myself for bruteforcing but I'm sure it won't be as efficient as what is offered on the internet.